SilverFox Cybercriminal Group Targets Companies with Fake Claude Apps
SilverFox, a notable cyber threat group, has been using counterfeit Claude applications to target businesses in India and other countries in the Asia Pacific region. Researchers from Kaspersky’s Global Research and Analysis Team (GReAT) report that this group is taking advantage of the increasing reliance on artificial intelligence (AI) tools in the business world to spread malware and infiltrate company networks.
How SilverFox Operates
According to Kaspersky analyst Ye Jin (Seth), SilverFox is one of the most active threat groups in the Asia Pacific area. They typically breach their targets through three main methods: fake websites, phishing emails, and malware-laden files shared via social messaging apps. These tactics allow them to implant malware that facilitates long-term spying and data collection. Recently, they have been distributing counterfeit versions of Claude for Windows, macOS, and Linux.
The attack methods employed by SilverFox involve a sophisticated, multi-step approach that uses separate infrastructures with unique addresses and domains at each stage. This segmentation can make it challenging for cybersecurity teams to spot and prevent the full scope of the attack.
Recent Campaigns
Recently, SilverFox has been active in various industries, targeting organizations in India, Indonesia, South Africa, and Russia. Phishing emails sent by the group are designed to appear as urgent tax audit notifications or messages prompting recipients to download files claiming to contain a list of tax violations. In January and February of 2026, Kaspersky identified over 1,600 malicious emails linked to these efforts. The emails often mimic official communication to create a sense of urgency, tricking recipients into opening harmful files.
The group’s tactics have expanded to include fake Claude apps—AI tools designed to assist with writing, coding, and document analysis, which have gained popularity in the workplace.
Focus on Asia
Kaspersky’s findings indicate that the Asia Pacific region is the primary target for SilverFox, with activity levels surpassing those in other regions. The group focuses heavily on Greater China, where over 90% of its attacks occur, including a significant number targeting mainland China. Other countries such as Myanmar, Cambodia, and Singapore are also seeing heightened activity. The manufacturing sector represents over a third of the group’s attacks, making it the most targeted industry according to Kaspersky’s data.
The Rising Threat of AI in Cyberattacks
Ye Jin has pointed out that the rise of AI is changing how cyberattacks are executed. For instance, there is a new ransomware attack known as JADEPUFFER, which utilizes AI to analyze failed attempts, modify strategies, and launch new attacks quickly. One notable case showed that the AI could complete the entire process of diagnosing a failure and planning a new attack in just 31 seconds, showcasing its capability to outpace human security teams.
Another concerning technique is called ChatGPhish, where malicious instructions are subtly integrated into webpages. When users interact with AI tools to summarize these pages, they risk processing harmful commands. An AI malware framework called VoidLink, identified in January 2026, illustrates how generative AI can simplify the process of creating malware.
Recommendations for Defense
In light of these developments, Kaspersky advises that organizations need to adapt their security measures to tackle AI-driven attacks. They suggest practices such as proactive AI-based threat hunting to detect unknown threats and implementing Zero Trust architectures, which verify access requests rather than automatically granting trust to users or devices within a network.
Additionally, a comprehensive defense approach covering endpoints, networks, applications, and data is recommended. Organizations should also leverage AI models and tools to enhance threat detection and adapt security strategies as attacks continue to evolve.
As both attackers and defenders increasingly employ AI, it is essential for organizations to consider AI-assisted phishing and automated attack processes alongside traditional cybersecurity threats.
