A malware campaign targeting users primarily in China and India is hiding the ValleyRAT remote-access trojan inside installers that appear to deliver adware or familiar applications. The chain turns a seemingly low-level nuisance into a durable surveillance foothold capable of stealing information, monitoring activity and bringing additional tools onto compromised Windows systems.

Researchers investigating suspicious traffic from an apparent adware sample found that its advertising function did not operate as expected. Instead, it installed a modified copy of QN Wallpaper and quietly launched ValleyRAT. Cyber Security News reports that the activity has been linked with likely involvement from the Silver Fox threat group.

Decoy behavior changes with the filename

The installer adapts what the victim sees according to its filename. Samples named FS_SETUP_DD_173.exe install the DingTalk collaboration application, while FS_SETUP_GG_173.exe presents Google Chrome. Another variant, FS_SETUP_HY_173.exe, opens a Tencent Meeting download page.

These actions provide plausible cover while malicious components are placed in the background. Regardless of the decoy, the installer deploys a tampered QN Wallpaper package under Program Files and configures it to start automatically. The strategy exploits users’ expectation that the download is merely installing a recognizable program or advertising-supported utility.

DLL sideloading launches the backdoor

The altered application abuses DLL sideloading, a technique in which a legitimate executable loads a malicious library from its own directory. In this campaign, QnWallpaper.exe and QnwPlayer.exe load a rogue libcef.dll. Attacker code therefore runs in the context of software that may look ordinary to a user or a cursory inspection.

The installer also attempts to weaken Microsoft Defender through the DisableAntiSpyware registry value. For persistence, the malicious library keeps QnWallpaper active after reboot using a file association and a matching file in the Startup folder. It checks whether the current user has administrative rights and may try to relaunch with elevation.

The ValleyRAT payload is encrypted, and its configuration is stored in reverse order to frustrate basic inspection. Different samples use separate command-and-control settings. The malware can inject into svchost.exe to restart itself, helping it blend into normal Windows activity and recover after disruption.

Surveillance, theft and follow-on payloads

ValleyRAT provides operators with a broad view of an infected computer. It can capture keystrokes and clipboard contents, identify the active window, take screenshots and gather host details such as the Windows version, local addresses, disk capacity, graphics hardware, system language and user idle time.

The backdoor can clear logs, change server addresses and retrieve additional components. It supports loading malicious libraries and process hollowing, in which hostile code runs inside a legitimate process. Depending on its configuration, ValleyRAT can search for security or traffic-analysis tools and mark its process as critical, potentially causing Windows to crash if a responder terminates it carelessly.

The observed scale is substantial even though it is geographically concentrated. Researchers recorded more than 100,000 ValleyRAT and related-malware detections during 2026 across over 1,500 unique users, mainly in China and India. Detection counts do not equal unique infections, but the figures show sustained distribution rather than an isolated test.

Detection and response priorities

• Look for unexpected QN Wallpaper installations and suspicious libcef.dll files beside its executables.
• Review Startup entries, file associations and new executables placed under the QN Wallpaper directory.
• Hunt for traffic to reported endpoints including 103.45.66[.]18 on ports 441–443 and 192.253.225[.]173 on ports 6666 or 8888.
• Investigate Defender configuration changes and unusual injection into svchost.exe.
• Isolate suspected machines, preserve evidence and reset credentials exposed through keyboard or clipboard monitoring.

Responders should avoid casually killing a suspicious process if it has been marked critical. Isolation and forensic acquisition may prevent data loss while preserving the chain for analysis. A compromised endpoint should also trigger an organization-wide hunt because the backdoor can download new tooling and stolen credentials may enable movement elsewhere.

Adware should not be dismissed as harmless

The campaign shows why unwanted software deserves investigation rather than automatic classification as a minor annoyance. Attackers can use adware distribution, legitimate executables and visible decoy installations to conceal a much more capable intrusion.

Organizations should restrict unapproved third-party software, obtain installers from verified publishers and prevent users from adding questionable programs to antivirus exclusions. Application control and monitoring for abnormal library loading can further reduce the chance that a trusted-looking executable becomes a launchpad for a persistent espionage tool.