Fake DeepSeek desktop-app sites pushed through search results install Silver Fox remote-access malware that kills antivirus

A Chinese-speaking crew (Silver Fox, per Huorong Security) runs look-alike DeepSeek websites that rank at the top of search results (Bing seen) and get repeated by AI assistants. They offer a 'DeepSeek for PC' download. DeepSeek ships no official desktop client. The multi-stage Windows loader checks for sandboxes and decrypts its modules in memory. It persists through hidden randomly named copies in the Public user folder, Run keys named after Tencent/Alibaba security components, a service and a scheduled task. It kills 212 antivirus processes (Windows Defender, Kaspersky, Avast, McAfee, 360 and others) through a vulnerable signed driver, adds Defender exclusions, blocks Windows Update and turns off UAC prompts. Then it gives the attacker remote control, collects data and can move to other machines. This version also targets WeCom (WeChat Work). At risk: staff who install AI tools themselves, mainly Windows users searching in Chinese. A victim reported an infection on 2026-10-15. An r/netsec post on 2026-10-28 describes a DeepSeek SEO-poisoning campaign deploying 'Kong RAT'. Its write-up could not be read, so it is unconfirmed whether that is the same activity. Start date unknown.

Summary written from the sources below. Check the originals before acting.