Silver Fox Phishing Campaign Now Uses Python Stealers Instead of RATs

Key Takeaways

• The China-linked threat actor Silver Fox (also known as Void Arachne) has shifted its attack methodology from remote access trojans (RATs) to custom Python-based information stealers.
• The campaign, active since early 2025, primarily targets South Asian countries, including Taiwan, Japan, Malaysia, India, Indonesia, Singapore, Thailand, and the Philippines.
• Attackers use sophisticated tax authority impersonation lures, often timed with real government announcements, to trick victims into downloading malicious files.
• The Python stealer collects credentials, browser data, and sensitive files, exfiltrating them to command-and-control (C2) servers disguised as legitimate services.

Silver Fox Threat Actor Shifts Tactics to Python Stealers in South Asia Campaign

The China-based threat group known as Silver Fox, also tracked as Void Arachne, has significantly evolved its operational tactics since early 2025. This sophisticated actor, previously reliant on remote access trojans (RATs), is now deploying a custom Python-based information stealer across multiple South Asian nations.

Active since at least 2022, Silver Fox initially gained notoriety for large-scale infection campaigns that leveraged SEO poisoning to distribute ValleyRAT, a modular backdoor also known as Winos. The recent pivot underscores the group’s continuous expansion of its geographic targets and its arsenal of malicious tools, consistently employing highly convincing tax authority impersonation schemes to establish initial access.

Campaign Evolution and Targeting

The current campaign has unfolded in three distinct waves between 2025 and 2026, systematically targeting organizations and individuals in Taiwan, Japan, Malaysia, India, Indonesia, Singapore, Thailand, and the Philippines.

The first wave, observed in January 2025, involved phishing emails impersonating Taiwan’s national taxation authority. These emails contained malicious PDF attachments that, when opened, exploited a hidden annotation feature to direct victims to download a ZIP archive. This archive contained python311.dll and an executable that collectively facilitated the side-loading of ValleyRAT. The timing of this campaign was deliberately synchronized with a genuine announcement from Taiwan’s Ministry of Finance regarding Year 113 tax audit selections, significantly enhancing the credibility of the lure.

Sekoia analysts documented a second wave in mid-December 2025, which saw Silver Fox broaden its target scope and modify its delivery mechanism. Instead of PDF attachments, phishing emails now included links to fake tax websites meticulously customized for the victim’s specific country. Downloads from these fraudulent sites delivered an archive containing a legitimate but improperly configured Chinese Remote Monitoring and Management (RMM) tool, digitally signed by “SyncFutureTec Company Limited.” Silver Fox exploited a configuration flaw by embedding the command-and-control (C2) address directly into the filename, using the format [IPv4]ClientSetup.exe. This technique preserved the file’s digital signature, allowing it to bypass immediate security scrutiny.

By February 2026, the RMM tool was replaced by a compiled Python stealer, marking the campaign’s third and most recent wave. Phishing websites during this phase were notably written in Malay, indicating a primary focus on targets in Malaysia. The stealer operated under the guise of a WhatsApp backup application, utilizing the User-Agent WhatsAppBackup/1.0 for communications with its C2 server, xqwmwru[.]top. Upon infection, it created C:WhatsAppBackupWhatsAppData.zip and a lock file within the %TEMP% directory. The C2 infrastructure was designed to mimic a legitimate WhatsApp web server, further enhancing its deceptive nature.

Python Stealer Infection Chain

The infection process for the Python stealer begins when a victim interacts with a phishing email and clicks an embedded link. This directs them to a fraudulent tax-themed website that meticulously mirrors a trusted government portal.

From this deceptive site, victims are prompted to download an archive, either a ZIP or RAR file, which unpacks into a single PE32+ executable. Executing this file launches the stealer, disguised as a WhatsApp backup utility. Once active, the malware proceeds to collect sensitive information, including credentials, browser data, stored files, and other critical data from the compromised device.

Collected data is then compressed and exfiltrated to the C2 server via two dedicated endpoints: https://xqwmwru[.]top/upload_large.php for data transfer and https://xqwmwru[.]top/upload_status.php to confirm successful transfers. The C2 panel itself features a structured backend designed for efficient management of stolen information across a large number of victims.

What You Should Do

• Exercise Extreme Caution with Tax-Related Communications: Treat all unsolicited emails concerning tax matters with suspicion, especially those containing attachments or links to external downloads. Verify the legitimacy of such communications directly with the official government agency using known, official contact methods, not through links or numbers provided in the email.
• Educate Finance and Security Teams: Provide regular training to finance personnel and general users on the tactics threat actors employ to impersonate government tax agencies in phishing campaigns. Emphasize the risks associated with clicking on suspicious links or opening unsolicited attachments.
• Implement Network Blocking: Block known malicious domains and C2 addresses, including xqwmwru[.]top, and any IPv4 addresses associated with the compromised RMM tool as published in threat intelligence reports.
• Enhance Endpoint Monitoring: Configure endpoint detection and response (EDR) tools to alert on the creation of WhatsAppBackup directories and the whatsapp_backup.lock file, as these serve as strong host-based indicators of compromise.
• Monitor Outbound Connections: Actively inspect outbound network connections, particularly those to newly registered domains or those with uncommon top-level domains (TLDs), as this can help identify potential data exfiltration attempts before sensitive information leaves the network.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.