#silver-fox

2 articles

The fake installer does not just add a Defender exclusion — it uses icacls so you cannot remove it

2026-09-03Security

Microsoft documented a campaign of counterfeit vendor sites whose installers disable four Windows Update services, rename the update DLLs, set Defender exclusions and then lock the ACLs against standard users. The payload hash changes on every download, so there is no hash to block.

The malware did not disable your antivirus. You did, to stop it complaining about the wallpaper app

2026-09-01Security

ValleyRAT is hiding inside QN Wallpaper, a genuine signed Chinese desktop app that bundles adware. Because the adware trips antivirus, users add it to the exclusion list — and the backdoor rides in through the hole they made. Kaspersky counted over 100,000 detections across 1,500-plus users, mostly in China and India.