Hackers Hide ValleyRAT Backdoor Inside Adware Targeting Users in China and India

Cybersecuritynews •Tushar Subhra Dutta • August 31, 2026

Hackers are using adware to deliver ValleyRAT, a Windows backdoor. The campaign primarily affects users in China and India, turning a program expected to display ads into a route for spying, theft, and further malware delivery. The installer changes its visible behavior according to its filename. One version installs a collaboration app, another installs a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ValleyRAT Backdoor Disguised as Signed Adware The ValleyRAT backdoor has been discovered masquerading as a legitimate adware application, specifically a modified version of QN Wallpaper. This malware, attributed to the threat actor Silver Fox, utilizes DLL sideloading to evade detection and gain control over infected systems. The attackers disable Windows Defender and create persistence through registry modifications. The backdoor can collect sensitive data, including keystrokes and screenshots, while appearing as a harmless installation. Kaspersky's analysis revealed that the adware's advertising functionality is non-operational, serving only as a cover for the malicious payload. Users are advised to avoid adding such software to antivirus exclusions and to be cautious of applications with dubious reputations. The attack highlights the risks associated with seemingly benign software that can be exploited for malicious purposes. 18 sources 65

Extracted Entities

Hackers Hide ValleyRAT Backdoor Inside Adware Targeting Users in China and India

The full story

Extracted Entities

Attack Types (1)

Countries (2)

Malware (1)

Platforms (1)