ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool
Kaspersky details ValleyRAT delivered via trojanized QN Wallpaper using DLL sideloading, tied to Silver Fox and hitting 1,500+ users in China and India.
Kaspersky found a malicious installer abusing a modified version of the legitimate QN Wallpaper adware application to deliver the ValleyRAT backdoor via DLL sideloading of libcef.dll. The installer masquerades as DingTalk, Chrome or Tencent Meeting software, creates persistence, disables Windows Defender via the DisableAntiSpyware registry key, and loads AES-encrypted payloads. ValleyRAT collects keystrokes, clipboard contents and screenshots plus system details, can download additional modules, and resists removal by injecting into svchost.exe or marking its process critical. The campaign was detected over 100,000 times in 2026, affecting more than 1,500 users mainly in China and India, and is attributed to Silver Fox with both espionage and financial motives.
- Abuses signed QN Wallpaper app for DLL sideloading via libcef.dll.
- Masquerades as DingTalk, Chrome or Tencent Meeting installers.
- Disables Defender via DisableAntiSpyware registry key and persists.
- ValleyRAT offers keylogging, clipboard theft, screenshots and module downloads.
- Silver Fox-linked; 100,000+ detections in 2026, mostly China and India.
- ATT&CK
- T1574.002 Hijack Execution Flow: DLL Side-LoadingT1562.001 Impair Defenses: Disable or Modify ToolsT1056.001 KeyloggingT1115 Clipboard DataT1113 Screen Capture
- Vendors
- Kaspersky
- Products
- QN Wallpaper
- Threat actors
- Silver Fox
- Malware
- ValleyRAT
- Organizations
- Cato CTRL
From the original article
5 min read at securityaffairs.com
ValleyRAT hides behind legitimate adware, using DLL sideloading to evade detection, steal data and give Silver Fox control of infected systems. ValleyRAT doesn’t always need to disguise itself as a cracked game or a fake browser update. It can also hide behind something much more ordinary: an application that looks like adware and appears to serve a legitimate purpose.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.