A new threat actor, codenamed Void Arachne, is targeting Chinese-speaking users through an intricate campaign that employs malicious software embedded within seemingly innocuous tools, including VPN installers and Chinese language packs. Uncovered in early April 2024, this activity cluster utilizes Windows Installer (MSI) files containing a command-and-control (C2) framework known as Winos 4.0. The campaign is notable for its distribution methods, which include search engine optimization (SEO) poisoning and the use of social media and messaging platforms, particularly Telegram channels themed around Chinese language content. Void Arachne promotes compromised software such as popular web browsers, VPN services, and deepfake pornography-generating applications, leveraging these tools to deliver malware. The malicious software is designed to bypass firewall protections and establish persistence on victims’ devices, ultimately enabling remote control over the compromised systems. Winos 4.0, the malware delivered through this campaign, is capable of a wide range of malicious activities, including file management, distributed denial-of-service (DDoS) attacks, webcam and microphone control, keylogging, and more, facilitated by a plugin-based system that can be expanded according to the attackers’ needs. The campaign specifically targets Chinese-speaking demographics, exploiting the increased public interest in VPN services due to the stringent internet regulations in China, known collectively as the Great Firewall. By offering software that promises to circumvent online censorship, Void Arachne aims to exploit this demand for its own malicious purposes. This threat activity underscores a broader trend of cybercriminals exploiting VPN technologies and other tools to target users in regions with heavy internet censorship, as well as an increase in cyberattacks aimed at Chinese citizens and organizations.