Poisoned Pipeline / Incidents / AS292
Microsoft counterfeit-installer campaign — same-named archives regenerate server-side per download
Windows softwareCDN / web assetsInstaller / update channel
Microsoft Defender Experts documented (1 September 2026) an active
campaign of counterfeit software-download websites impersonating
trusted vendors — Razer, Microsoft Edge, Kaspersky, Baidu Netdisk,
Calibre, and others — that distribute malicious installer archives,
primarily affecting China-based operations of multinational
organizations and Chinese-speaking users. Microsoft assesses with
moderate confidence that the activity is consistent with the publicly
reported Silver Fox (Yinhu) fake-software campaign. The defining
delivery characteristic: archive families (app_setup.*, zinst.*,
zintall.*, intsoft.*, innstll.*) keep the same filename while the
contents change on every download — server-side payload regeneration
(two content-distinct copies of app_setup.6653004.zip observed written
within roughly 69 seconds) — which defeats URL-reputation and static
hash blocklists. A wrapped installer drops a randomized-path stage-one
payload (stable SHA-256 676a2a7b94ca… under many names), masqueraded
with fabricated version metadata including an unfilled build-template
"TODO: <Product name>" placeholder; a repurposed Indigo Rose TrueUpdate
client runtime fetches further payloads from attacker-controlled
Alibaba Cloud OSS over TLS. Same fake-installer class as AS88/AS61
(brandjacked download pages), not a registry hijack.
Mapped techniques
- T0136 Brandjacking
- T0110 Advertise malicious artifact
- T0207 Skip or forge artifact integrity verification
- T0159 Malicious artifact execution
- T0148 Scheduled tasks on self hosted runner
- T0176 Disable or misconfigure security measures
- T0184 Harvesting sensitive information from files
supply-chain counterfeit download-site distribution
High-fidelity clones of vendor sites on .com.cn/.hl.cn
look-alike domains with prominent "Download now" buttons.
The spoofed download pages advertise the impersonated vendors'
popular products.
Hashes change on every download while the filename stays
constant; static hash blocklists cannot key on the payload.
post-supply-chain Windows victims executing the installers
The wrapped installer launches the stage-one payload from a
randomized path under C:\Users\Public or Program Files (x86).
The persistent payload (c6100166e2d3…) is launched repeatedly by
the Task Scheduler service and disables Windows Update services
(wuauserv / UsoSvc / WaaSMedicSvc).
Registry keys set for Defender exclusions and Windows Update
policy; vssadmin delete shadows /all /quiet removes recovery.
Attempted SMB remote file access to additional hosts; implants
communicate with attacker-controlled infrastructure.
Framework gaps noted
- Server-side per-download payload regeneration has no dedicated technique; T0212 is the closest existing technique (routing) and this story records the behaviour explicitly instead of force-mapping it.