Silver Fox Targets Japanese Firms with Tax and HR Phishing During Filing Season

What happened

Silver Fox launched a spearphishing campaign targeting Japanese manufacturers during the annual tax filing season. The emails impersonated tax authorities and HR departments, promising tax compliance updates, salary adjustments, job position changes, and employee stock ownership plans. Recipients were lured into opening malicious links or attachments that delivered malware or credential‑stealing payloads.

Impact

Companies that rely on routine tax and HR communications are at higher risk because employees expect such messages. The campaign has already compromised several mid‑size manufacturers, leading to credential theft and lateral movement within corporate networks.

What to do

Defenders should:

• Verify the sender’s domain and email header before clicking links.
• Use email filtering rules that flag tax‑or HR‑related phishing templates.
• Educate staff to report suspicious messages to the security team immediately.
• Deploy endpoint protection with real‑time malware detection.
• Enable multi‑factor authentication for all employee accounts.

Mitigation

Implement a zero‑trust approach to email attachments, enforce least privilege, and conduct regular phishing simulations focused on tax and HR scenarios.

Silver Fox has been active since 2023 and has expanded from Chinese‑speaking targets to Southeast Asia, Japan, and potentially North America.