The Silver Fox threat group, also known as Void Arachne or SwimSnake, has initiated a sophisticated multi-stage remote access trojan (RAT) campaign targeting Chinese-speaking users. This campaign primarily utilizes a network of typosquatted domains that mimic trusted applications that are widely used in China, such as VPN clients, encrypted messaging tools, and e-commerce applications. The distribution channels rely on eleven identified domains that impersonate reputable software brands, and all delivery installers are signed with a stolen Extended Validation (EV) code-signing certificate from a Vietnamese entity.