🚨 Chinese users targeted with fake WPS Office & DeepSeek sites—delivering Sainbox RAT + Hidden rootkit.

It’s the same group behind past fake Chrome installers.

Stealthy, low-effort, and still active.