{"id":"CMP-202610-fake-deepseek-desktop-app-sites-pushed-through-search-result","kind":"campaign","aliases":[],"related":[],"title":"Fake DeepSeek desktop-app sites pushed through search results install Silver Fox remote-access malware that kills antivirus","description":null,"summary":"A Chinese-speaking crew (Silver Fox, per Huorong Security) runs look-alike DeepSeek websites that rank at the top of search results (Bing seen) and get repeated by AI assistants. They offer a 'DeepSeek for PC' download. DeepSeek ships no official desktop client. The multi-stage Windows loader checks for sandboxes and decrypts its modules in memory. It persists through hidden randomly named copies in the Public user folder, Run keys named after Tencent/Alibaba security components, a service and a scheduled task. It kills 212 antivirus processes (Windows Defender, Kaspersky, Avast, McAfee, 360 and others) through a vulnerable signed driver, adds Defender exclusions, blocks Windows Update and turns off UAC prompts. Then it gives the attacker remote control, collects data and can move to other machines. This version also targets WeCom (WeChat Work). At risk: staff who install AI tools themselves, mainly Windows users searching in Chinese. A victim reported an infection on 2026-10-15. An r/netsec post on 2026-10-28 describes a DeepSeek SEO-poisoning campaign deploying 'Kong RAT'. Its write-up could not be read, so it is unconfirmed whether that is the same activity. Start date unknown.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-28T15:56:54+00:00","products":[{"name":"DeepSeek","note":"impersonated; fake desktop client, the service itself is not compromised","fixed":[],"vendor":"DeepSeek"},{"name":"Windows","fixed":[],"vendor":"Microsoft"},{"name":"WeCom","fixed":[],"vendor":"Tencent"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look in DNS, proxy and EDR logs for eeszuu.com, lgtnfx.net, lwuoys.net, any *.cdn-deepseek.com.cn, connections to 8.218.106.149:7000, 92.48.71.103:9000 or 92.48.71.103:20032, and downloads from 26usdm.oss-cn-beijing.aliyuncs.com, 2bbaz2.oss-cn-beijing.aliyuncs.com, mm2027.oss-cn-hangzhou.aliyuncs.com or nm25.cn-hangzhou.aliyuncs.com. On Windows endpoints, look for any installed 'DeepSeek' desktop program, hidden randomly named folders under C:\\Users\\Public, Run keys or services posing as Tencent/Alibaba security, new Defender exclusions, Windows Update disabled, or UAC prompts turned off.","fix":"Block the listed domains, IPs and OSS buckets. Isolate and reimage any machine that ran a 'DeepSeek desktop' installer, because the malware disables antivirus and updates. Then rotate the passwords and sessions used on that machine, including WeCom and browser-saved logins. Tell staff that DeepSeek is web and mobile only, and that AI tools come from the approved software catalogue. Turn on the Microsoft vulnerable-driver blocklist.","status":"open","published_at":null,"first_seen_at":"2026-10-28T15:56:54+00:00","triaged_at":"2026-10-28T15:56:54+00:00","updated_at":"2026-10-28T15:56:54+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':201B,208B '-15':202B '-202610':22A '-28':209B '2026':200B,207B '212':131B '360':139B 'access':16A 'activ':237B 'add':147B 'ai':74B,185B 'alik':57B 'also':175B 'antivirus':20A,132B 'app':5A,27A 'assist':75B 'attack':162B 'avast':137B 'bing':68B 'block':150B 'campaign':40B,216B 'check':95B 'chines':46B,193B 'chinese-speak':45B 'client':88B 'cmp':21A 'collect':165B 'compon':122B 'control':164B 'copi':110B 'could':224B 'crew':48B 'data':166B 'date':239B 'decrypt':99B 'deepseek':2A,25A,37A,58B,79B,83B,212B 'defend':135B,148B 'deploy':217B 'describ':210B 'desktop':4A,26A,87B 'desktop-app':3A 'download':82B 'driver':146B 'earli':42B 'early-warn':41B 'exclus':149B 'fake':1A,24A 'fake-deepseek-desktop-app-sites-pushed-through-search-result':23A 'folder':115B 'fox':13A,34A,50B 'get':71B 'give':160B 'hidden':107B 'huorong':52B 'infect':198B 'instal':11A,184B 'kasperski':136B 'key':117B 'kill':19A,130B 'kong':35A,218B 'loader':94B 'look':56B 'look-alik':55B 'machin':172B 'main':188B 'malwar':17A 'mcafe':138B 'memori':103B 'modul':101B 'move':169B 'multi':91B 'multi-stag':90B 'name':109B,118B 'offer':77B 'offici':86B 'other':141B 'pc':81B 'per':51B 'persist':105B 'poison':215B 'post':205B 'process':133B 'prompt':157B 'public':113B 'push':7A 'pushed':29A 'r/netsec':204B 'random':108B 'rank':61B 'rat':36A,219B 'read':227B 'remot':15A,163B 'remote-access':14A 'repeat':72B 'report':196B 'result':10A,32A,67B 'risk':181B 'run':54B,116B 'sandbox':97B 'schedul':127B 'search':9A,31A,66B,191B 'secur':53B,121B 'seen':69B 'seo':214B 'seo-poison':213B 'servic':124B 'ship':84B 'sign':145B 'silver':12A,33A,49B 'site':6A 'sites':28A 'speak':47B 'staff':182B 'stage':92B 'start':238B 'target':176B 'task':128B 'tencent/alibaba':120B 'through':30A 'tool':186B 'top':64B 'turn':154B 'uac':156B 'unconfirm':231B 'unknown':240B 'updat':152B 'user':114B,190B 'version':174B 'victim':195B 'vulner':144B 'warn':43B 'websit':59B 'wechat':178B 'wecom':39A,177B 'whether':232B 'window':93B,134B,151B,189B 'windows':38A 'work':179B 'write':222B 'write-up':221B","nicknames":["Silver Fox","Kong RAT"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-fake-deepseek-desktop-app-sites-pushed-through-search-result","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-28T15:56:54+00:00","fetched_at":"2026-10-28T15:56:54+00:00","note":null}],"documents":[{"id":11145,"url":"https://x.com/_r_netsec/status/2115466961367032155","title":"@_r_netsec: SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong","kind":"post","source":"x","text":"SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks https://t.co/8qdmxjxOBg\n\nlikes 5 reposts 1","published_at":"2026-10-28T15:33:21+00:00","relation":"describes","confidence":null,"note":null},{"id":11156,"url":"https://1275.ru/ioc/gruppirovka-silver-fox-poddelala-sayt-deepseek-i-vydayot-vredonosnuyu-programmu-za-pk-klient_38841","title":"Silver Fox fakes the DeepSeek site and serves malware as a desktop client (Huorong Security research, IOCs)","kind":"blog","source":"analyst","text":"Summary of Huorong Security research: Silver Fox runs look-alike DeepSeek sites pushed to the top of search results (also surfaced by AI assistants) offering a fake DeepSeek desktop client (DeepSeek ships no desktop client as of 31 Aug 2026). The multi-stage loader checks for sandboxes, decrypts modules in memory and pulls more from external servers. Persistence: hidden randomly named copies in the Public user folder, Run keys named like Tencent/Alibaba security components, a service and a scheduled task, launched through a trusted system binary. New in this version: targets the WeCom corporate messenger. Kills 212 AV processes (Huorong, 360, Kaspersky, Tencent, Avast, Avira, McAfee, Baidu, Kingsoft, Rising, Windows Defender) using a vulnerable legitimate monitoring driver (BYOVD), adds Defender exclusions, blocks Windows Update, disables UAC prompts. Remote control, data collection, lateral movement. IOCs: 8.218.106.149:7000, 92.48.71.103:20032, 92.48.71.103:9000; domains eeszuu.com, lgtnfx.net, lwuoys.net; URLs 26usdm.oss-cn-beijing.aliyuncs.com, 2bbaz2.oss-cn-beijing.aliyuncs.com, mm2027.oss-cn-hangzhou.aliyuncs.com, nm25.cn-hangzhou.aliyuncs.com.","published_at":"2026-10-20T05:13:02+00:00","relation":"describes","confidence":null,"note":null},{"id":11157,"url":"https://www.nodeseek.com/post-986290-1","title":"NodeSeek user infected by fake DeepSeek desktop download found via Bing (65web.cdn-deepseek.com.cn)","kind":"blog","source":"analyst","text":"Forum victim report, 2026-10-15: Bing search result led to a random subdomain of cdn-deepseek.com.cn (e.g. 65web.cdn-deepseek.com.cn) that changes on every click; user ran a 23 MB trojan posing as DeepSeek for PC; Edge opened 3 extension pages and the exe deleted itself; persistence via disguised files, startup and service entries.","published_at":"2026-10-15T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":11117,"url":"https://www.reddit.com/r/netsec/comments/1xhqj0w/seo_poisoning_campaign_targets_deepseek_users/","title":"r/netsec: SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks","kind":"post","source":"reddit","text":"SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks\n\nsubmitted by /u/CyberMasterV [link] [comments]","published_at":"2026-10-28T15:03:44+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}