ReliaQuest has assessed with high confidence that an ongoing search engine optimization (SEO) poisoning campaign impersonating Microsoft Teams is the work of the Chinese advanced persistent threat (APT) group “Silver Fox,” (aka Void Arachne) despite false indicators suggesting a Russian threat actor. Active since November 2025, this campaign targets Chinese-speaking users, including those within Western organizations operating in China, using a modified “ValleyRAT” loader containing Cyrillic elements—likely an intentional move to mislead attribution. Overlapping infrastructure with previous campaigns further indicates its ties to Silver Fox.