Public research from OIS Threat Research, Open Information Security Inc.https://oisthreat.com/enhttps://oisthreat.com/en/research/silverfox-part1-inno-setup-loader/https://oisthreat.com/en/research/silverfox-part1-inno-setup-loader/Silver Fox APT wraps a malicious Pascal script inside an Inno Setup installer that performs environment reconnaissance, adds the entire C: drive to the Defender exclusion list, disables network adapters to block reporting, and then decrypts and drops the next-stage loader men.exe — this report reconstructs the landing stage of that seemingly normal installer.Wed, 11 Feb 2026 00:00:00 GMT