Spoofed vendor download pages hand out a fresh payload hash on every click

This chain's durable artifact is the referrer URL. Microsoft's FileOriginReferrerUrl telemetry ties each downloaded archive back to the impersonation page that served it, plus rotating delivery hosts at yimxg25tiy[.]com/73inst, cc8ttkv35b[.]com/7qinst and n7b8t85zsg[.]com/ins711, and a suspected attacker-controlled Alibaba Cloud Object Storage bucket ^[12]. A hunt query can hold onto that referrer chain, but not the file itself: Microsoft counted at least five same-named archive families, app_setup.*, zinst.*, zintall.*, intsoft.* and innstll.*, whose contents differ between requests while the delivery URL stays put ^[6][14].

The scale of that shows in the numbers. On one device, two content-distinct copies of app_setup.6653004.zip were written roughly 69 seconds apart from the same constant URL after a visit to the fake Razer page pc-razerzone[.]com[.]cn ^[5]. If the server builds a payload per request, then a hash added to a blocklist covers exactly one download, and 69 seconds is the gap between two observations rather than a rotation interval to tune against ^[15].

Behind the brand pages there is less infrastructure than the variety suggests. Kaspersky, Razer and Calibre look-alikes on .hl.cn and .com.cn all pointed at www.gehie246[.]com/712down, three unrelated vendors sharing one delivery path ^[7][13]. Microsoft describes a large uniform set of these pages, each cloning real product branding behind a prominent download button, all funnelling to the same payload infrastructure ^[8]. Taking down one lure page leaves the shared delivery infrastructure behind it untouched.

What lands establishes persistence, attempts to weaken security protections, and calls attacker infrastructure ^[4], with privilege escalation and defense evasion sitting between execution and command and control in the chain Microsoft published ^[10]. Defender caught and disrupted it at several of those stages, including automated containment ^[9]. Note the order of Microsoft's own guidance: prevent downloads from untrusted software sources first, then SmartScreen, network protection, tamper protection and XDR ^[11]. The first item is a procurement and allowlisting decision about permitted sources, while the rest are product toggles.

This is one publisher's telemetry, and Microsoft puts only moderate confidence on the activity matching the publicly reported Silver Fox, or Yinhu, fake-software campaign, with no nation-state attribution ^[1]. Victim concentration is regional ^[3], but nothing in the mechanism is: it works wherever a user fetches an installer themselves. Choosing which sources may supply software is what resolves a payload that is unique per victim, not detection tuning, and that choice sits with whoever owns the software request path rather than the SOC.