ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
- ID
- 19794
- Status
- summarized
- Published
- 31 Aug 2026, 8:14 PM
- Fetched
- 31 Aug 2026, 9:16 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 31 Aug 2026, 9:21 PM
- Tags
- Audience
- developers
What happened
The Silver Fox threat group is distributing the ValleyRAT backdoor (Winos 4.0) bundled inside QN Wallpaper, a legitimate signed Chinese adware app, using DLL sideloading to run malicious code inside a trusted process. The installer disables Windows Defender via the DisableAntiSpyware registry key, adds itself to autorun, escalates privileges with runas, and marks its process as critical so termination triggers a BSOD. Kaspersky published IoCs including file hashes and C2 servers (103.45.66.18:441-443, 192.253.225.173:6666/8888).
Why it matters
This is a consumer-targeted adware-to-RAT campaign with no direct bearing on AI tooling, developer infrastructure, or SaaS workflows this audience ships. The only actionable detail for builders is the DLL sideloading pattern (signed exe + planted libcef.dll) worth noting if you ship desktop installers or maintain endpoint exclusion policies for your own software.
Discussion angle
If your team ships signed desktop software and asks users to add it to AV exclusions, this campaign is a concrete example of why that practice is weaponizable — discuss whether your installers genuinely need exclusions or can be restructured to avoid the ask.