Foxveil

Foxveil is a previously undocumented Windows malware loader assessed by Cato CTRL to have been active since August 2025. It abuses legitimate cloud/platform services—Cloudflare Pages, Netlify-hosted domains, and short-lived Discord attachment links (~24-hour lifetime)—as threat actor-controlled staging locations to retrieve next-stage payloads, primarily Donut-generated shellcode, in order to blend into normal enterprise traffic and evade reputation-based blocking.

Foxveil has at least two variants with different execution/injection tradecraft:

• Variant 1 downloads shellcode (and additional executables) from Cloudflare Pages/Netlify, spawns a fake svchost.exe process, and executes the payload via Early Bird APC injection (queueing the APC while the target process is suspended before it fully resumes).
• Variant 2 retrieves payloads from Discord attachments and performs self-injection within the same process context.

Persistence and staging behaviors reported include registering itself as a Windows service (noted for v1) and dropping additional executables/next-stage payloads into SysWOW64 using filenames that mimic legitimate Windows processes (e.g., sihost.exe, taskhostw.exe). Foxveil also includes a runtime string-mutation/rewriting mechanism intended to hinder static detection and reverse engineering by replacing “high-signal” strings (e.g., “payload,” “inject,” “shellcode,” “beacon,” “meterpreter,” “http://,” “.exe”) with randomly generated values during execution. One report notes v2 attempted to manipulate Microsoft Defender exclusions but appeared to remove an exclusion for SysWOW64 rather than add one (possibly operator error).

Cato CTRL noted indicators suggesting Cobalt Strike may be a later-stage payload (e.g., mutation list including “beacon” and observed localhost listening behavior on ports 9933 and 9934), but this was presented as an assessment rather than confirmed payload identification. Cato reported the malicious infrastructure to Cloudflare and Netlify; Netlify removed reported URLs on Jan. 19, 2026, and Cloudflare restricted access to reported URLs on Jan. 20, 2026.