Weaponized DeepSeek Installers Deploy Sainbox RAT and Hidden Rootkit

Netskope Threat Labs unearthed a sneaky campaign pulling the ol' bait-and-switch. Users are duped by sham software installers that pack a one-two punch: Sainbox RAT and a Hidden rootkit. Like digital magicians, these attackers impersonate legit sites, such as WPS Office, to hook their prey. The culprits slip in under the radar with Shine.exe, sideloading malware while whistles stay silent—a cheeky trick courtesy of the Silver Fox crew.