Cato CTRL researchers have uncovered “Foxveil,” a new malware loader active since August 2025 that hides payloads on trusted platforms like Cloudflare Pages, Netlify, and Discord.
This stealthy tool evades detection by blending into normal web traffic and employing advanced injection techniques.
Foxveil Variants
Foxveil operates as an initial loader that retrieves shellcode from attacker-controlled sites, runs it in memory, and establishes persistence. Researchers spotted two variants with key differences in staging, injection, and evasion.
Variant 1 pulls payloads mainly from Cloudflare Pages or Netlify, spawns a fake svchost.exe process, and injects shellcode via the Early Bird Asynchronous Procedure Call (APC) technique.
This method queues the payload before the target thread fully starts, dodging monitors. It then persists by registering as a Windows service named AarSvc and drops next-stage files into C:\Windows\SysWOW64.
Variant 2 shifts to Discord attachments for shellcode, often generated by the Donut tool, and uses self-injection in the same process. Both variants mutate strings like “fox,” “payload,” “inject,” “shellcode,” “meterpreter,” “beacon,” and URLs to frustrate analysis tools.
They also drop suspicious files such as sms.exe, sihost.exe, taskhostw.exe, and audiodg.exe into SysWOW64, mimicking legit Windows processes.
Variant 2 attempts to tweak Microsoft Defender via WMI and run a command to remove exclusions on SysWOW64, though it might be flawed.
| Capability | Foxveil v1 | Foxveil v2 |
|---|---|---|
| Primary staging | Cloudflare/Netlify | Discord attachment |
| Injection | Early Bird APC into fake svchost.exe | Self-injection |
| Persistence | Registers as AarSvc service; drops to SysWOW64 | Drops to SysWOW64 |
| Evasion | String mutation | String mutation + Defender tweak |
| Post-exploitation | Suspected Cobalt Strike | Suspected Cobalt Strike |
Evasion and Defenses
Attackers favor Cloudflare, Netlify, and Discord for staging because these services appear normal in traffic logs, making rotation easier without owning risky domains.
Foxveil starts by executing a malicious EXE or DLL, fetching shellcode, injecting it, and deploying additional payloads.
Memory execution leaves few disk traces, while string swaps hide clues from static scans. Later stages hint at Cobalt Strike use, including localhost ports such as 9933 or 9934 and beacon-related strings.
Defenders must watch behaviors over domains: odd process chains, SysWOW64 writes, or Defender changes.
Cato reported the sites; Netlify took down URLs on January 19, 2026, and Cloudflare restricted them on January 20. Discord links expired fast. Cato’s SASE platform blocks it early via network checks.
| IOC | Type | Details |
|---|---|---|
| AarSvc | Service Name | v1 persistence mechanism |
| C:\Windows\SysWOW64\sms.exe, sihost.exe, etc. | File Paths | Masqueraded next-stage drops |
| wmic … Remove ExclusionPath=”C:\Windows\SysWOW64” | WMI Command | v2 Defender manipulation |
| Ports 9933/9934 | Network | Localhost listening, possible Cobalt Strike |
| Mutated strings: fox, payload, beacon | Code Artifacts | Anti-analysis routine |
Cato Networks said, foxveil shows how loaders evolve to use legit clouds, urging full-stack visibility. Cato’s tools correlate signals to stop chains before execution.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
.webp?fit=1600,900&ssl=1&description=Cato CTRL researchers have uncovered "Foxveil," a new malware loader active since August 2025 that hides payloads on trusted platforms){kind=link}