Back Cybersecuritynews

Tax Audit Phishing Campaign Tied to Silver Fox Shifts From RATs to Python Stealers

Cybersecuritynews •Tushar Subhra Dutta • March 26, 2026

A China-based threat actor known as Silver Fox, also tracked as Void Arachne, has significantly evolved its attack approach since early 2025, shifting from deploying remote access trojans to distributing a custom Python-based stealer across South Asia. Active since at least 2022, the group first gained attention through mass infection campaigns that used SEO poisoning […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Silver Fox Targets Japanese Firms with Spearphishing During Tax Season The Silver Fox cyber threat group is conducting a targeted spearphishing campaign against Japanese businesses, particularly manufacturers, during the annual tax filing and corporate restructuring season. The attackers exploit the high volume of legitimate financial and HR communications, using emails that impersonate internal departments and executives. Common phishing lures include tax compliance violations and salary adjustments, which make employees more likely to trust and act on these messages. The campaign has been active since at least 2023 and has expanded from Chinese-speaking targets to include Japan and Southeast Asia. The malicious emails typically contain links or attachments that deploy ValleyRAT, a remote access trojan, allowing attackers to gain unauthorized access to systems. Silver Fox has a history of aligning its operations with regional business cycles, as similar phishing activity was observed in Japan last year. Organizations are advised to enhance employee awareness and verify all financial requests through separate communication channels. 8 sources 70

Extracted Entities

Tax Audit Phishing Campaign Tied to Silver Fox Shifts From RATs to Python Stealers

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

Campaigns (1)

MITRE ATT&CK (1)