← Back to Feed

SilverFox: Tracking the Distribution of a Domestic Variant of a Malicious Installation File Posing as KakaoTalk

September 27, 2026 · AhnLab ASEC · Severity: HIGH

AhnLab ASEC tracked the SilverFox group distributing a malicious KakaoTalk installer via SEO poisoning. The installer's packaging evolved through multiple tools, and it bundled legitimate code with malware to appear authentic. 📌 **Analyst Note:** This case highlights the sophistication of supply chain attacks targeting popular software. Users should download applications only from official sources, and security teams should monitor for SEO-manipulated search results.

Key Takeaways

  • The SilverFox threat actor uses SEO poisoning to redirect users searching for KakaoTalk to fake sites hosting a malicious installer disguised as the legitimate application.
  • The attacker continuously changed the installer's packaging, sequentially using NSIS, Advanced Installer, and Inno Setup to evade detection and complicate analysis.
  • The malicious installer contains both legitimate installation components and hidden malware, making it harder for users and antivirus tools to distinguish from the real KakaoTalk.
☕ Buy a Coffee