---
id: "CMP-202610-fake-deepseek-desktop-app-sites-pushed-through-search-result"
kind: "campaign"
aliases: []
title: "Fake DeepSeek desktop-app sites pushed through search results install Silver Fox remote-access malware that kills antivirus"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "DeepSeek", "note": "impersonated; fake desktop client, the service itself is not compromised", "fixed": [], "vendor": "DeepSeek"}, {"name": "Windows", "fixed": [], "vendor": "Microsoft"}, {"name": "WeCom", "fixed": [], "vendor": "Tencent"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-28T15:56:54+00:00"
updated_at: "2026-10-28T15:56:54+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-28T15:56:54+00:00"}]
---

# Fake DeepSeek desktop-app sites pushed through search results install Silver Fox remote-access malware that kills antivirus

A Chinese-speaking crew (Silver Fox, per Huorong Security) runs look-alike DeepSeek websites that rank at the top of search results (Bing seen) and get repeated by AI assistants. They offer a 'DeepSeek for PC' download. DeepSeek ships no official desktop client. The multi-stage Windows loader checks for sandboxes and decrypts its modules in memory. It persists through hidden randomly named copies in the Public user folder, Run keys named after Tencent/Alibaba security components, a service and a scheduled task. It kills 212 antivirus processes (Windows Defender, Kaspersky, Avast, McAfee, 360 and others) through a vulnerable signed driver, adds Defender exclusions, blocks Windows Update and turns off UAC prompts. Then it gives the attacker remote control, collects data and can move to other machines. This version also targets WeCom (WeChat Work). At risk: staff who install AI tools themselves, mainly Windows users searching in Chinese. A victim reported an infection on 2026-10-15. An r/netsec post on 2026-10-28 describes a DeepSeek SEO-poisoning campaign deploying 'Kong RAT'. Its write-up could not be read, so it is unconfirmed whether that is the same activity. Start date unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :DeepSeek affected ? fixed ?
- :Windows affected ? fixed ?
- :WeCom affected ? fixed ?

## How to check

Look in DNS, proxy and EDR logs for eeszuu.com, lgtnfx.net, lwuoys.net, any *.cdn-deepseek.com.cn, connections to 8.218.106.149:7000, 92.48.71.103:9000 or 92.48.71.103:20032, and downloads from 26usdm.oss-cn-beijing.aliyuncs.com, 2bbaz2.oss-cn-beijing.aliyuncs.com, mm2027.oss-cn-hangzhou.aliyuncs.com or nm25.cn-hangzhou.aliyuncs.com. On Windows endpoints, look for any installed 'DeepSeek' desktop program, hidden randomly named folders under C:\Users\Public, Run keys or services posing as Tencent/Alibaba security, new Defender exclusions, Windows Update disabled, or UAC prompts turned off.

## Fix

Block the listed domains, IPs and OSS buckets. Isolate and reimage any machine that ran a 'DeepSeek desktop' installer, because the malware disables antivirus and updates. Then rotate the passwords and sessions used on that machine, including WeCom and browser-saved logins. Tell staff that DeepSeek is web and mobile only, and that AI tools come from the approved software catalogue. Turn on the Microsoft vulnerable-driver blocklist.

## Timeline

- 2026-10-28T15:56:54+00:00 analyst

## Documents

- [describes] @_r_netsec: SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong https://x.com/_r_netsec/status/2115466961367032155
- [describes] Silver Fox fakes the DeepSeek site and serves malware as a desktop client (Huorong Security research, IOCs) https://1275.ru/ioc/gruppirovka-silver-fox-poddelala-sayt-deepseek-i-vydayot-vredonosnuyu-programmu-za-pk-klient_38841
- [describes] NodeSeek user infected by fake DeepSeek desktop download found via Bing (65web.cdn-deepseek.com.cn) https://www.nodeseek.com/post-986290-1
- [discussion] r/netsec: SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks https://www.reddit.com/r/netsec/comments/1xhqj0w/seo_poisoning_campaign_targets_deepseek_users/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_