{"id":2614,"date":"2026-08-31T13:15:13","date_gmt":"2026-08-31T13:15:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2614"},"modified":"2026-08-31T13:15:13","modified_gmt":"2026-08-31T13:15:13","slug":"valleyrat-backdoor-hides-in-signed-adware-that-users-add-to-antivirus-exclusions","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2614","title":{"rendered":"ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Aug 31, 2026<\/span><\/span>Malware \/ Endpoint Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The threat actor known as Silver Fox<\/b> has been observed distributing the ValleyRAT <\/b>backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions.<\/p>\n

Russian cybersecurity vendor Kaspersky said the attackers built the disguise around QN Wallpaper<\/b>, a genuine Chinese desktop-wallpaper tool that in its unmodified form is adware, bundling partner apps and displaying ad banners.<\/p>\n

Once installed, ValleyRAT (also tracked as Winos 4.0) hands the operator full control of the compromised machine. Kaspersky said the attack’s geography and payload point to Silver Fox as the likely group behind it, and urged users to avoid software of questionable reputation and to keep it away from security-tool exclusions.<\/p>\n

\u00abThis case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear. ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules,\u00bb Kaspersky said in its analysis<\/a>.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The disguise relies on DLL sideloading. The installer unpacks a modified copy of QN Wallpaper and runs its signed executable, QnWallpaper.exe<\/code>, which loads a malicious libcef.dll<\/code> planted in the same directory. With the library executing inside a legitimately signed process, the backdoor runs without triggering controls that trust the signature.<\/p>\n

<\/p>\n

Before the adware component starts, the installer switches off Windows Defender through the DisableAntiSpyware<\/code> registry key and adds the program to the system’s autorun entries. When the logged-in user lacks administrator rights, the malware relaunches itself with runas<\/code> to acquire them.<\/p>\n

ValleyRAT can also flag its own process as critical, so that any attempt to terminate it triggers a blue screen of death.<\/p>\n

\"\"<\/a><\/div>\n

Kaspersky shared the following indicators of compromise (IoCs) –<\/p>\n