A newly uncovered campaign has revealed that the ValleyRAT backdoor is being delivered under the guise of a signed Chinese adware tool, allowing it to evade antivirus detection—even when installed on systems with traditionally strong defenses.
How the Attack Works
Threat actors associated with the Silver Fox group have been deploying ValleyRAT by modifying a legitimate desktop wallpaper application called QN Wallpaper. In its original form, QN Wallpaper functions as basic adware, bundling partner apps and displaying banners. However, in this campaign, the software has been tampered with to introduce malicious behavior.
The trick lies in DLL sideloading. The installer includes a legitimate signed executable called QnWallpaper.exe, which in turn loads a malicious DLL file (libcef.dll) placed in the same folder. That DLL operates under the umbrella of the trusted executable, bypassing signature-based security checks.
Capabilities & Persistence Methods
Once installed, ValleyRAT grants attackers full control over the infected machine. The malware can grab keystrokes, access clipboard data, take screenshots, and download additional malicious modules. It also can disable Windows Defender by manipulating the DisableAntiSpyware registry key, ensure it starts every time the system boots, and even request elevated permissions using runas if the current user lacks admin rights.
Another alarming capability is marking its own process as “critical”—any attempt to kill it triggers a system crash (Blue Screen of Death), making removal significantly harder.
Geography, Victim Scope & Technical Clues
The campaign appears focused on users primarily located in China and India. Security researchers observed over 100,000 ValleyRAT detections in 2026 so far, affecting more than 1,500 individual users. It’s not yet clear how many of those infections stem specifically from this DLL sideloading under adware scheme.
Key indicators of compromise include distinct file hashes for the installer and DLL, specific command-and-control servers and domains, and markers within the system such as the install directory C:\Program Files\QNWallpaper\5.4.0.1662\ and the disabled Windows Defender registry setting.
Why Signature Trust and Exclusions Are Dangerous
This attack leverages naturally trusted elements—legit signed executables and software often whitelisted by users or organizations. Because many people exclude adware or presumed benign tools from their antivirus scans or blocklists, a signed executable can become a vector for deeper compromise.
Silver Fox has used similar tactics before. Earlier incidents involved abusing legitimate apps for DLL sideloading, using the same libcef.dll filename in ValleyRAT loaders discovered in previous campaigns. One such case targeted a Japanese manufacturer just weeks before this recent campaign.
Defensive Measures
Security vendors are urging organizations to scrutinize any software added to antivirus exclusions—even if it’s signed. Policies should be established around third-party software on company devices, and staff should be educated to scrutinize adware tools before dismissing them as harmless.
For individual users, avoiding software of dubious reputation and refraining from marking such tools as excluded in security solutions is critical.
Security researchers provided detailed indicators of compromise to help defenders detect and respond to this threat.
Analytical Take: This campaign exposes a dangerous blind spot—trusted signatures and user-managed exclusions can be weaponized. ValleyRAT demonstrates a nuanced shift, where attackers don’t need to invent entirely new malware—they simply cloak existing backdoors under legitimacy. Moving forward, threat actors will likely continue to exploit whitelisting safeguards and blurring lines between benign tools and malicious payloads. The key question now is whether endpoint security tools can evolve fast enough to go beyond simplistic trust models and monitor behavior, not just signatures and exclusion lists.
