Foxveil is a newly identified initial-stage malware loader first seen in August 2025. It pulls Donut-generated shellcode from “trusted” hosting surfaces—Cloudflare Pages, Netlify, and Discord attachments—then runs it through process-injection techniques. For persistence, the loader either registers a Windows service or attempts to tamper with Microsoft Defender settings. Across observed variants, the main differences are the staging source, the injection approach, and the persistence method.
Cato researchers analyzed two Foxveil variants and documented the end-to-end flow: shellcode retrieval, injection via Early Bird APC (or direct self-injection), and persistence through a service named AarSvc. Dropped artifacts were observed under C:\Windows\SysWOW64 using masqueraded filenames to blend with legitimate components. The loader also includes string-mutation logic that rewrites high-signal terms to reduce static detections. Network telemetry showed connections to multiple Cloudflare and Netlify domains, with occasional fetches from Discord attachment URLs.
The Cato SASE platform blocked the loader before payload execution by inspecting download behavior and suspicious process creation patterns. To reduce risk, block known staging domains and alert on injection-related behavior associated with Foxveil’s tradecraft. Disable untrusted script execution and harden policies around Windows Defender exclusions to limit persistence attempts. Keep allow-list rules for legitimate cloud services current to minimize false positives while maintaining coverage.
If Foxveil activity is detected, isolate the endpoint, terminate the malicious process, and remove any registered service (including AarSvc). Perform forensic review of SysWOW64 for dropped executables and collect hashes for scoping. Pivot on network logs for connections to identified staging domains and block them at DNS/proxy layers. Roll out detections for Early Bird APC injection and self-injection patterns across the fleet to identify additional impacted hosts.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands
Regression Test Script
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
