The File Everyone Would Open
The scene below is illustrative. The filename in it is real.
It is a weekday morning in the Shanghai office of a US company. For months there have been rumors about headcount. Nobody in management will confirm anything, and everybody has a theory about which team goes first. Then a file shows up in a chat window or an inbox, forwarded by someone, or appearing to be:
2026.裁员名单及补偿方案WPS.exe
To anyone who reads Chinese, the meaning lands instantly: 2026 Layoff List and Compensation Plan. The "WPS" suggests a document made in WPS Office, the Kingsoft office suite that is standard on a great many machines in China. With Windows hiding known file extensions by default, the ".exe" at the end may never be seen at all. What the employee sees is a document that answers the only question on their mind: am I on the list?
There is no list. The file is a Windows executable, and in the malware data I track it is tagged ValleyRAT, a remote access trojan that gives an attacker control of the machine it runs on.
This lure does not need to be clever. It needs to be relevant. Security awareness training asks people to pause before opening something unexpected. A file that claims to decide whether you still have a job is not something most people pause on. It is exactly the kind of document a nervous employee has been waiting for, and the click happens before the question of whether it is safe comes up.
What My Data Showed
As part of my own research, I built a threat intelligence platform called ArgusX that collects public threat feeds into a single database I can search. One of those feeds is MalwareBazaar, a public repository where security researchers share malware samples along with tags describing what they are. I searched it for every sample tagged ValleyRAT or SilverFox and pulled the 15 most recent. They were first seen between September 17 and September 19, 2026, a window of about 50 hours. The layoff file was one of them. The other fourteen tell a broader story.
| Lure Family · Meaning | Filename (as Submitted) |
|---|---|
| Workplace fear 1 sample 2026 layoff list and compensation plan |
2026.裁员名单及补偿方案WPS.exe |
| Language pack 3 samples "Click to install" a Chinese language pack |
点击安装简体中文包.msi 点击安装中文语言包z.exe 点击此处安装中文语言包!!A.exe |
| Trusted software 3 samples LetsVPN; Sandboxie Plus "from the 360 store" |
LetsVPN.exe Letspn_ sandboxieplus_ |
| Generic installer 6 samples Numbered, no brand |
install_ install_ install_ install_ install_ |
| No lure name 2 samples A DLL and a hash-named file |
PDFCORE8.dll c48ff5d56bb26fbc |
Four details stood out to me.
The language pack lure is not new. In April 2026, researchers documented a Silver Fox MSI named 点击安装中文语言包a.msi ("Click to Install Chinese Language Pack a"), posing as a Telegram Chinese language pack and delivering ValleyRAT along with a kernel rootkit. The September sample 点击安装中文语言包z.exe uses the same wording with a different letter suffix. Five months later, the same lure is still circulating.
The installers are numbered. install_s.6.01, 6.02, 6.03, 6.06, and install_a.8.15 read like build numbers. install_s.6.02.exe appears twice with two different hashes, one first seen September 17 and one September 18. The same name with a different hash means the file was rebuilt without being renamed.
One sample is signed. LetsVPN.exe carries a "signed" tag. A valid-looking signature makes a file more convincing to a user and can lower suspicion in some automated checks. LetsVPN is a VPN client widely used by Chinese-speaking users, and Silver Fox has impersonated it in earlier, publicly documented campaigns.
One sample can be traced to a download site. My platform also collects URLhaus, a public feed of URLs used to distribute malware. On September 19, MalwareBazaar first saw sandboxieplus_
What this data does and does not show. MalwareBazaar's first-seen time is when a sample was submitted, not when a victim received it. Several of these samples were submitted within minutes of each other (the three language-pack files within four minutes on September 19, and five files within about four minutes on September 18), which looks like a researcher uploading a batch, not the attacker's delivery schedule. MalwareBazaar also does not record how a file reached its victim, so this data cannot tell me whether the layoff file arrived by email, by chat app, or from a download page. And a ValleyRAT tag is not proof of Silver Fox: the ValleyRAT builder leaked publicly on GitHub in March 2025, so other operators can build it too. Twelve of the fifteen samples carry a SilverFox tag as well; that tag is the submitter's attribution, not mine.
Who This Is Built For
Every lure name in this set is aimed at a Chinese-speaking Windows user. The filenames are in Simplified Chinese. The software being impersonated (a Chinese language pack, LetsVPN, a program labeled as coming from the 360 software store, a document made in WPS) is what someone working in the Chinese software ecosystem would expect to see. Public reporting on earlier Silver Fox installer lures describes locale checks built into the malware, which fits the same targeting.
That matches what is documented about Silver Fox more broadly. ESET reports the group initially focused on Chinese-speaking targets before expanding its operations across Asia. Over the past year it has been reported sending tax-authority lures to organizations in India and Russia, and spearphishing Japanese companies with lures about salary adjustments, job position changes, and employee stock plans. Sekoia describes the group as running both espionage-style and profit-driven operations at the same time.
The layoff file belongs to that same family of lures. It does not pretend to be from a bank or a delivery service. It pretends to be from inside your own company, about the thing people at work are most afraid of. ESET's Japan reporting shows Silver Fox has already used salary and HR themes against companies. A layoff list is the same idea, turned up.
Why a US security team should care
It is easy to read "Chinese-language lure, Chinese-speaking targets" and conclude this is someone else's problem. For any US company with offices, staff, or contractors in China, it is not. The employees in those offices use the same local software ecosystem these lures imitate, read the same news about layoffs, and connect to the same corporate network as everyone else. I have no evidence that this particular file was sent to a US company. The point is simpler: if it were, nothing about it would look out of place to the person receiving it.
The practical question for a defender is not "does this campaign target us?" It is "would our tooling, and our people, notice a lure written in a language most of our security team cannot read?" If the analyst triaging an alert needs a translation tool to understand the filename, the lure has already bought time.
What a Defender Can Actually Use
My first idea for a detection rule was the combination above: a Chinese filename, an executable, and a document-style lure name. Before writing it, I checked it against the open-source Sublime Security detection ruleset. An executable inside an archive, a shortcut (LNK) file, an MSI installer, and a password-protected zip from an unsolicited sender each already have their own rule, and a program attached directly to an email is blocked by default by both Gmail and Microsoft 365. A filename-language rule would mostly repeat that coverage, and flagging email because it is written in Chinese, Arabic, Korean, or Russian would be both wrong and useless, because millions of legitimate business emails are written in those languages every day.
So I looked at how these files actually travel. I searched my data for PDF samples tagged ValleyRAT or SilverFox and found none. I then pulled the 20 most recent URLhaus download links with those tags that end in .exe, .msi, .zip, or .rar, added between August 27 and September 19, 2026. Every one is a web download. They include lookalike software sites (sandboxle.com.cn for Sandboxie, and download-sougou.com.cn serving a misspelled "sougouExpiorerr" installer for the Sogou browser), an archive named BraveBrows.zip, a file hosted on Volcano Engine, ByteDance's cloud storage, and a group of zips and executables on random-looking domains. The ValleyRAT sample I analyzed in an earlier lab pulled its payload from Tencent cloud storage the same way. My data does not show this campaign arriving by email.
Defensible takeaway: For staff, treat any program (.exe, .msi, or the same inside an archive) whose name promises a document, such as a layoff list, a salary notice, or a tax form, as a verify-first file regardless of where it came from. Confirm with HR or the sender through a separate channel. No legitimate HR process delivers a layoff list as a program you run. For security teams, the delivery this data shows is lookalike download sites and abused cloud storage, so the controls that matter are installing software only from official sources or an internal software portal, and web filtering that catches lookalike and newly registered domains. On the email side, existing rules already cover the main ways these files could arrive, so this campaign does not call for a new one.
Indicators
| Filename · SHA256 | First Seen (UTC) |
|---|---|
| 2026.裁员名单及补偿方案WPS.exe 832e3c40bb74c638 | 2026-09-18 15:54 |
| LetsVPN.exe 5385a2b091db5ae1 | 2026-09-19 19:51 |
| sandboxieplus_ 12c2b43d44bd9238 | 2026-09-19 15:32 |
| 点击此处安装中文语言包!!A.exe f01277ab480cde96 | 2026-09-19 12:34 |
| 点击安装中文语言包z.exe d3f5b2ed1b616c63 | 2026-09-19 12:32 |
| 点击安装简体中文包.msi fab24a3d4dccd29c | 2026-09-19 12:31 |
| Letspn_ 7da191c3d8b15e0c | 2026-09-18 15:58 |
| install_ 7b08f5cc5f06bb80 | 2026-09-18 15:57 |
| install_ aaa2332239867048 | 2026-09-18 15:56 |
| install_ c9b9c20fd7ef5a89 | 2026-09-18 15:56 |
| PDFCORE8.dll 7c1ab2209ed95a0a | 2026-09-18 11:10 |
| c48ff5d56bb26fbc 6d44eb601b419e43 | 2026-09-18 05:58 |
| install_ e95116115fba848a | 2026-09-17 17:51 |
| install_ fc155f603f547eab | 2026-09-17 17:50 |
| install_ a828a86c9ad60a78 | 2026-09-17 17:49 |
The most effective part of this campaign is not technical. It is a filename that speaks directly to a fear, in the language of the person reading it. That costs the attacker almost nothing to write, and it is the part that gets the file opened.
Sample data from the author's own research, collected through ArgusX, a threat intelligence platform the author built to gather public threat feeds (source feeds: MalwareBazaar, 15 most recent samples tagged ValleyRAT or SilverFox, first seen September 17–19, 2026; URLhaus, 20 most recent ValleyRAT, SilverFox, or Winos download URLs ending in .exe, .msi, .zip, or .rar, added August 27 to September 19, 2026, all offline at time of query). Tags and attribution are as submitted to MalwareBazaar and URLhaus. April 2026 Telegram Chinese language pack campaign reported by GBHackers and Cybersecurity News (April 9, 2026). Silver Fox targeting of Chinese-speaking users, HR and salary lures against Japanese businesses: ESET (March 2026). Tax-themed campaigns against India and Russia: Kaspersky Securelist (2026). Dual espionage and cybercrime model: Sekoia (2026). Prior LetsVPN impersonation, locale checks, and the March 2025 ValleyRAT builder leak: Malwarebytes (February 2026) and Cybereason. Sublime Security ruleset review performed by the author against the public repository, September 2026. ValleyRAT sample pulling its payload from Tencent cloud storage: the author's earlier lab analysis. Default attachment blocking: Google Gmail and Microsoft Outlook documentation. The opening scene is illustrative. This field note represents independent research produced for educational purposes.