The threat actor known as Silver Fox is at it again. This time, they're hiding a nasty backdoor inside a Chinese adware app called QN Wallpaper. And here's the kicker, the malware runs under a trusted, signed executable. So if you've added this adware to your antivirus exclusions, you're in trouble.

Kaspersky caught the campaign. The attackers took a legit desktop-wallpaper tool called QN Wallpaper, which normally just shows ads and bundles partner apps, and turned it into a delivery vehicle for the ValleyRAT backdoor.

Here's what's going on.

Quick Summary

How They Do It

Step 1: The Disguise

The installer unpacks a modified copy of QN Wallpaper. Then it runs the signed executable, QnWallpaper.exe. That executable loads a malicious libcef.dll from the same folder.

Step 2: DLL Side-Loading Trick

And here is where the ingenuity lies. The backdoor runs inside a legitimately signed process. Security tools trust the signature, so they don't raise any alarms.

Step 3: Before the Adware Even Starts

• The installer kills Windows Defender by tweaking the DisableAntiSpyware registry key
• It adds itself to startup so it runs every time you boot up
• If you don't have admin rights, it relaunches itself to get them

Step 4: The Critical Process Flag

ValleyRAT can mark itself as a critical system process. If you try to kill it, your computer blue-screens. Nice, right?

What ValleyRAT Actually Does

Once it's in, ValleyRAT hands the attacker full control of your computer.

It Can:

• Record everything you type (keystrokes)
• Steal what's in your clipboard
• Take screenshots of your screen
• Download and run additional malware

What Kaspersky Said:

"ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules."

Who's Getting Hit

Kaspersky recorded more than 100,000 detections of ValleyRAT in 2026. That affected over 1,500 unique users.

The Hotspots:

• China
• India

These numbers cover all ValleyRAT activity this year, not just this particular campaign.

The Technical Details (Indicators of Compromise)

Hashes (MD5):

C2 Servers:

• 103.45.66.18 on ports 441, 442, and 443
• 192.253.225.173 on ports 6666 and 8888

Domains to Watch:

• qnwallpaper[.]keansoft[.]cn (where the adware comes from)
• meeting[.]tencent[.]com (a legit page used as a decoy)

Registry & Files:

• The DisableAntiSpyware registry value
• C:\Program Files\QNWallpaper\5.4.0.1662\

Silver Fox Has Done This Before

DLL sideloading isn't new for this group. They've used it before.

Earlier This Year:

• Cato Networks documented them using the same trick against a Japanese manufacturer
• The same libcef.dll filename appeared in a 2025 ValleyRAT loader
• Kaspersky tracked them in a tax-themed campaign against India and Russia

What This Means for You

The Danger:

"This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear," Kaspersky said.

The Advice:

• Don't install sketchy software
• If you do, don't add it to your antivirus exclusions
• Set policies on what software can run on work devices
• Tell your team about this threat

What Organizations Should Do

1. Audit Your Software

Check what's installed on work devices. Adware doesn't belong on corporate systems.

2. Review Your Exclusions

Look at your antivirus exclusions. If you've whitelisted anything sketchy, remove it.

3. Look Out for DLL Sideloading

Take care of the signed executables that have their DLLs loaded from the same folder.

4. Train Your People

Make sure your team knows about this. Adware can be a backdoor in disguise.

The Bottom Line

Silver Fox is using QN Wallpaper adware to deliver ValleyRAT. The attackers rely on DLL sideloading through a signed executable to evade detection.

What You Need to Know:

What you need to do:

• Avoid sketchy software
• Do not add suspicious content to exclusions list
• Check out your work devices
• Train your employees

FAQ Section

What is the Silver Fox ValleyRAT adware disguise?

Silver Fox is hiding ValleyRAT inside a signed Chinese adware app called QN Wallpaper. The malware executes itself using a trusted process to remain undetected.

How does the attack work?

The installer unpacks a modified QN Wallpaper. The signed executable uses DLL sideloading to load the malicious libcef.dll and runs the backdoor from within a trusted process.

ValleyRAT is capable of what?

ValleyRAT is a high-level backdoor that is capable of keylogging, stealing clipboard information, taking screenshots and downloading malware.

Who is being targeted?

Mainly users in China and India. Kaspersky saw over 100,000 detections affecting more than 1,500 people.

What should I do?

Avoid sketchy software. Never add it to your antivirus exclusions. Audit third-party software on work devices.

Source: The Hacker News