ValleyRAT is spreading disguised as adware

Attackers distribute ValleyRAT backdoor disguised as QN Wallpaper adware. The malicious installer deploys a modified wallpaper management tool and leverages DLL sideloading to run malicious code under a signed process. ValleyRAT provides advanced backdoor functionality including keylogging, clipboard monitoring, screenshot capture, and delivery of additional modules. The campaign has affected over 1,500 unique users primarily in China and India, with more than 100,000 detections in 2026. The Silver Fox threat group is attributed. The malware disables Windows Defender, establishes persistence mechanisms, and uses process protection techniques such as marking processes as critical to trigger system crashes if terminated.

ValleyRAT enables attackers to maintain persistent backdoor access with capabilities to monitor user input, capture clipboard data, take screenshots, and deploy additional malicious modules. It disables Windows Defender, reducing endpoint protection effectiveness. Process protection techniques increase difficulty of removal by causing system crashes if terminated. The campaign has resulted in widespread infections primarily in China and India, indicating significant operational impact in those regions.

No specific patch or vendor advisory is available for this malware. Mitigation should focus on detecting and blocking the malicious QN Wallpaper installer and DLL sideloading behavior. Endpoint protection solutions should be updated to detect ValleyRAT signatures and behaviors. Users should avoid installing untrusted software, especially from unofficial sources. Manual removal may require booting into safe mode or using specialized malware removal tools due to the malware's disabling of Windows Defender and process protection techniques. Network monitoring for command and control traffic associated with ValleyRAT may aid detection.