Kaspersky Warns of ValleyRAT Spyware Campaign Across Asia

October 16, 2026: Kaspersky experts uncovered a ValleyRAT campaign exploiting QN Wallpaper adware to execute malware through DLL sideloading, disguised under a legitimate developer certificate. The backdoor can steal sensitive data, including keystrokes and clipboard contents, capture screenshots, control system shutdowns and reboots, and deploy additional malicious modules.

“ValleyRAT is a highly sophisticated backdoor that covertly performs spyware functions, putting sensitive data belonging to both individual users and organizations at risk. Normally these kinds of attacks rely on the fact that sometimes legitimate applications do not verify the libraries loaded into their address space. This allows attackers to replace a legitimate library with a malicious one bearing the same name, which the trusted application then loads without raising suspicion. As a result, the installation often goes unnoticed. Users often allow the installation of potentially unwanted software or adware on their devices, but this is one of the scenarios for malware to enter their computers, as our research proves. Therefore, we do not recommend ignoring antivirus messages about unwanted or adware,” says Vasily Kolesnikov, cybersecurity expert at Kaspersky.

Kaspersky researchers with a high degree of confidence attribute this campaign to SilverFox, a known operator of the malware family used in the described attacks. The group targets organizations across multiple countries for both cyberespionage and financial gain.

Read the full report on Securelist.com

Kaspersky recommends avoiding downloads from untrusted sources, never disabling security tools, and not adding suspicious applications to security exclusions. Organizations should establish third-party software policies, educate employees on cyber threats, strengthen protection with managed detection and response, and monitor credentials for signs of compromise. Kaspersky solutions support threat detection, security awareness, and digital footprint monitoring to mitigate cyber risks.