Cato CTRL Threat Research: Foxveil – New Malware Loader Abusing Cloudflare, Discord, and Netlify as Staging Infrastructure

Summary

Foxveil is a newly identified initial-stage malware loader first seen in August 2025. It pulls Donut-generated shellcode from “trusted” hosting surfaces—Cloudflare Pages, Netlify, and Discord attachments—then runs it through process-injection techniques. For persistence, the loader either registers a Windows service or attempts to tamper with Microsoft Defender settings. Across observed variants, the main differences are the staging source, the injection approach, and the persistence method.

Investigation

Cato researchers analyzed two Foxveil variants and documented the end-to-end flow: shellcode retrieval, injection via Early Bird APC (or direct self-injection), and persistence through a service named AarSvc. Dropped artifacts were observed under C:\Windows\SysWOW64 using masqueraded filenames to blend with legitimate components. The loader also includes string-mutation logic that rewrites high-signal terms to reduce static detections. Network telemetry showed connections to multiple Cloudflare and Netlify domains, with occasional fetches from Discord attachment URLs.

Mitigation

The Cato SASE platform blocked the loader before payload execution by inspecting download behavior and suspicious process creation patterns. To reduce risk, block known staging domains and alert on injection-related behavior associated with Foxveil’s tradecraft. Disable untrusted script execution and harden policies around Windows Defender exclusions to limit persistence attempts. Keep allow-list rules for legitimate cloud services current to minimize false positives while maintaining coverage.

Response

If Foxveil activity is detected, isolate the endpoint, terminate the malicious process, and remove any registered service (including AarSvc). Perform forensic review of SysWOW64 for dropped executables and collect hashes for scoping. Pivot on network logs for connections to identified staging domains and block them at DNS/proxy layers. Roll out detections for Early Bird APC injection and self-injection patterns across the fleet to identify additional impacted hosts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands

  1. Reconnaissance: The attacker has obtained the Foxveil staging domain syscore.pages.dev from a compromised credential dump.
  2. Stage 1 – DNS Resolution: Using a native Windows tool, the attacker resolves the staging domain to obtain the IP address of the malicious payload host. This step mirrors the real malware behavior and is the observable trigger.
  3. Stage 2 – Payload Retrieval (not executed in test): In a real attack the resolved IP would be used to download the second‑stage payload via HTTP. For the purpose of detection validation, only the DNS resolution is required.

• Regression Test Script

  <# 
  Simulate Foxveil staging domain resolution.
  This script performs a DNS query for a known Foxveil domain,
  generating the exact telemetry the Sigma rule monitors.
  #>
  
  # Define the staging domain (chosen from the rule's whitelist)
  $stagingDomain = "syscore.pages.dev"
  
  # Resolve the domain – this generates a DNS query event
  try {
      $result = Resolve-DnsName -Name $stagingDomain -Type A -ErrorAction Stop
      Write-Host "Resolved $stagingDomain to $($result.IPAddress)"
  } catch {
      Write-Error "DNS resolution failed: $_"
  }
  
  # Optional: pause to ensure the log pipeline processes the event
  Start-Sleep -Seconds 5

• Cleanup Commands

  # Flush the DNS cache to remove the resolved entry (prevents caching effects on subsequent tests)
  ipconfig /flushdns
  Write-Host "DNS cache flushed."