Cybersecurity researchers have uncovered a sophisticated malware campaign exploiting the popularity of artificial intelligence tools to target Chinese-speaking users.
The attack leverages fake installers masquerading as legitimate software downloads, including the popular AI chatbot DeepSeek, to deploy advanced persistent threats onto victim systems.
This campaign represents a concerning evolution in social engineering tactics, where threat actors capitalize on emerging technology trends to enhance their attack success rates.
The malicious operation employs a multi-stage infection process that begins with carefully crafted phishing websites mimicking official software distribution pages.
.webp)
Victims are lured into downloading what appears to be legitimate installers for popular Chinese applications such as WPS Office, Sogou, and DeepSeek.
These counterfeit installers, primarily distributed as MSI files, contain sophisticated payloads designed to establish long-term system compromise while maintaining stealth through advanced evasion techniques.
Netskope analysts identified this campaign during routine threat hunting activities, discovering that the fake installers deliver two primary malicious components: the Sainbox RAT, a variant of the notorious Gh0stRAT family, and a modified version of the open-source Hidden rootkit.
The researchers have attributed these activities to the Silver Fox group, a China-based adversary collective, with medium confidence based on tactical patterns, infrastructure analysis, and targeting preferences.
The attack’s technical sophistication becomes apparent upon examination of its infection mechanism.
When executed, the malicious MSI installer performs a deceptive dual operation, simultaneously installing the legitimate software to avoid user suspicion while deploying its malicious payload through a complex side-loading technique.
Infection Mechanism and Persistence Tactics
The core of this attack relies on DLL side-loading, a technique that exploits the Windows dynamic library loading process to execute malicious code.
The fake installer drops three critical files: a legitimate executable named “Shine.exe,” a malicious DLL masquerading as “libcef.dll” (a legitimate Chromium Embedded Framework library), and a data file called “1.txt” containing encoded shellcode and the final payload.
.webp)
The infection chain initiates when Shine.exe executes and automatically loads the malicious libcef.dll through the Windows side-loading mechanism.
The DLL’s exported function “cef_api_hash” serves as the entry point, immediately establishing persistence by writing the Shine.exe path to the Windows registry Run key under the name “Management.”
This ensures the malware survives system reboots and maintains long-term access to the compromised system.
The malicious DLL subsequently reads the contents of “1.txt,” which contains a 0xc04-byte shellcode based on the open-source sRDI (Shellcode Reflective DLL Injection) tool.
This shellcode performs reflective DLL loading, injecting the Sainbox RAT directly into memory without touching the disk, thereby evading many traditional detection mechanisms and establishing a sophisticated command-and-control infrastructure for persistent system compromise.
Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now
