Silver Fox Exploits Income Tax Phishing to Deploy ValleyRAT in India (2025)

In December 2025, the Chinese-origin threat group Silver Fox launched a sophisticated phishing campaign targeting Indian users with income tax-themed emails. Victims received emails purportedly from India’s Income Tax Department containing decoy PDF attachments. When recipients opened the PDFs, they were redirected to a malicious website serving a ZIP file with a trojanized installer. The infection leveraged DLL hijacking and a legitimate executable to sideload malware, ultimately installing ValleyRAT—a modular remote access trojan—by process hollowing. Once active, ValleyRAT enabled attackers to harvest credentials, establish persistence, and communicate via encrypted channels for ongoing control.

This incident highlights the convergence of advanced phishing lures, supply chain manipulation, and evasive malware tailoring persistent access to high-value targets across public, financial, healthcare, and technology organizations. ValleyRAT’s modularity, anti-analysis features, and delayed communication underline a pivot towards low-noise, highly adaptive attacks exploiting human trust and regulatory touchpoints.

The Silver Fox ValleyRAT campaign showcases the growing threat of sophisticated phishing and modular malware in the Asia-Pacific region. With adversaries continuously evolving their social engineering, persistence mechanisms, and evasion tactics, organizations must immediately strengthen defense in depth, particularly around user awareness, east-west security, and threat detection.