Back Cybersecuritynews

Silver Fox Abuses Stolen EV Certificates in AtlasCross RAT Malware Campaign

Cybersecuritynews •Guru Baran • March 26, 2026

The Chinese-nexus advanced persistent threat group Silver Fox, also tracked as Void Arachne and SwimSnake, is actively targeting Chinese-speaking users and professionals with a sophisticated AtlasCross RAT campaign. Security researcher Maurice Fielenbach of Hexastrike found that threat actors leveraging typosquatted domains impersonating trusted software brands like Surfshark, Signal, and Zoom use stolen Extended Validation (EV) […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Silver Fox Targets Japanese Firms with Spearphishing During Tax Season The Silver Fox cyber threat group is conducting a targeted spearphishing campaign against Japanese businesses, particularly manufacturers, during the annual tax filing and corporate restructuring season. The attackers exploit the high volume of legitimate financial and HR communications, using emails that impersonate internal departments and executives. Common phishing lures include tax compliance violations and salary adjustments, which make employees more likely to trust and act on these messages. The campaign has been active since at least 2023 and has expanded from Chinese-speaking targets to include Japan and Southeast Asia. The malicious emails typically contain links or attachments that deploy ValleyRAT, a remote access trojan, allowing attackers to gain unauthorized access to systems. Silver Fox has a history of aligning its operations with regional business cycles, as similar phishing activity was observed in Japan last year. Organizations are advised to enhance employee awareness and verify all financial requests through separate communication channels. 8 sources 70

Extracted Entities

Silver Fox Abuses Stolen EV Certificates in AtlasCross RAT Malware Campaign

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)