ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Summary: Kaspersky reported that the Silver Fox group distributed the ValleyRAT backdoor (also tracked as Winos 4.0) disguised as QN Wallpaper, a genuine signed Chinese adware application, using DLL sideloading so a malicious libcef.dll loads inside the trusted QnWallpaper.exe process. The installer disables Windows Defender via the DisableAntiSpyware registry key, adds autorun entries, relaunches with runas when the user lacks admin rights, and can flag its own process as critical so termination triggers a blue screen; Kaspersky's account rests on a single customer-submitted installer and gives no victim count for this campaign.
What you should know: The infection path depends on users adding signed adware to antivirus exclusion lists, which turns a routine IT convenience into the delivery mechanism for a backdoor that captures keystrokes and clipboard contents. Kaspersky recorded more than 100,000 ValleyRAT detections affecting over 1,500 unique users across 2026, mostly in China and India.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026