Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains

**AtlasCross RAT campaign (Silver Fox)** — A Chinese-speaking-targeted campaign uses typosquatted domains impersonating trusted software brands to distribute AtlasCross RAT via trojanized Autodesk installers and ZIP lures; the malware incorporates a PowerChell execution framework, disables AMSI/ETW/ScriptBlock logging, uses ChaCha20-encrypted C2, and supports DLL injection, RDP hijacking, and persistence, while installers are signed with a stolen EV certificate and multiple delivery domains and IoCs have been identified.