New Threat Actor 'Void Arachne' Targets Chinese Users with Malicious VPN Installers

**Void Arachne** is a campaign targeting Chinese-speaking users that uses malicious MSI installers (posed as VPNs, language packs, and deepfake/AI tools) distributed via SEO poisoning and messaging platforms to deploy the Winos 4.0 backdoor — a plugin-based C++ implant capable of DDoS, keylogging, webcam/microphone capture, remote shell, persistence, and evasion; follow-up analysis links active abuse to an actor tracked as Silver Fox.