Loading story…
A malware campaign is using fake Microsoft Teams download pages promoted on X to lure corporate users into installing trojanized ZIP archives that deploy ValleyRAT. Researchers said the infection chain relies on an NSIS installer and DLL sideloading through Tencent’s legitimate GameBox.exe, then uses PowerShell to add Windows Defender exclusions, hide files, and establish persistence through unauthorized service creation and registry artifacts including _CCGDAT.
Once executed, the loader decrypts staged payloads from user.dat in memory using AES and XOR, with additional evasion through API hashing and reflective loading. The final ValleyRAT payload captures keystrokes, clipboard contents, and active-window activity before exfiltrating data to command-and-control infrastructure at 103.215.77.17; researchers said the campaign shows Chinese-language artifacts and behavioral overlaps that likely tie it to the SilverFox APT cluster.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
LevelBlue reported a ValleyRAT infection chain first observed in 2026 in which phishing emails in Traditional Chinese or Japanese delivered a ZIP archive containing a legitimate VLC executable and a malicious libvlc.dll for DLL sideloading. The malware established persistence, downloaded an RC4-encrypted payload, and injected ValleyRAT into a suspended rundll32.exe process for in-memory execution.
The reporting assessed the activity as likely linked to the SilverFox APT group, citing Chinese-language artifacts, log data, and behavioral overlap with prior ValleyRAT activity. One source also described the campaign as likely linked to China.
Researchers reported that the ValleyRAT variant captured keystrokes, clipboard contents, and active window activity before exfiltrating data. The campaign's command-and-control infrastructure included communications to 103.215.77.17.
Analysis revealed the infection chain used an NSIS-based installer, DLL sideloading through Tencent's legitimate GameBox.exe, and PowerShell to add Windows Defender exclusions. The malware then decrypted staged payloads in memory and established persistence through hidden files, registry artifacts, and a service.
Researchers identified a malware campaign in mid-April in which fake Microsoft Teams download sites were promoted on X to deliver trojanized ZIP archives. The lures targeted corporate users seeking enterprise communication software.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
levelblue.com
Open sourcesecurityonline.info
Open sourcelabs.k7computing.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have launched multiple campaigns distributing the ValleyRAT remote access trojan (RAT), targeting both organizations in China and job seekers. In one campaign, the group known as Silver Fox used search engine optimization (SEO) poisoning and fake Microsoft Teams installers to lure Chinese-speaking users, including those in Western companies operating in China, into downloading a trojanized setup file. The installer, disguised with Russian linguistic elements to mislead attribution, deploys ValleyRAT, which enables remote control, data exfiltration, and persistent access to infected systems. The malware loader checks for security software like 360 Total Security and manipulates Microsoft Defender exclusions to evade detection. A separate ValleyRAT campaign has been observed targeting job seekers via malicious emails that leverage a weaponized Foxit PDF Reader for DLL side-loading. This campaign uses social engineering to trick users into executing the malware, which then allows attackers to monitor activity, steal sensitive data, and potentially compromise HR professionals as well. Both campaigns demonstrate a high level of sophistication, utilizing layered obfuscation, dynamic execution techniques, and strategic targeting to maximize infection rates and evade security controls. Security vendors have updated detection and hunting capabilities to address these threats, emphasizing the need for vigilance among organizations and individuals alike.
Jun 29, 2026
Threat actors are impersonating corporate IT support staff in **Microsoft Teams** voice calls to trick employees into granting remote access and installing the **EtherRAT** remote access trojan. The campaign begins with a phishing email themed as an **"Employee Survey"**, then shifts to a Teams call from an external Microsoft 365 tenant, where the caller poses as helpdesk or system administration staff and persuades the target to enable screen sharing and install legitimate remote management tools such as **HopToDesk** or **AnyDesk**. Attackers then execute a malicious MSI installer, including samples such as `v7.msi`, to deploy a multi-stage loader that fetches a legitimate **Node.js** runtime, decrypts embedded payloads, and launches EtherRAT. Researchers said EtherRAT is a cross-platform Node.js RAT for **Windows, Linux, and macOS** that supports command execution, file manipulation, persistence, and data theft. The malware uses **Ethereum smart contracts** to locate active command-and-control infrastructure, with some reporting also noting a fallback conventional domain, making disruption more difficult. Investigators found multiple installer versions in an open directory, including versions 1 through 9, indicating active development, and identified Teams forensic artifacts such as files beginning with `CtrlVirtualCursorWin_*` that may show an attacker remotely controlled a victim's desktop during a session. The activity adds to a broader rise in Teams-based impersonation attacks, even as Microsoft rolls out protections such as external caller warnings and stricter handling of suspected third-party bots.
Jul 7, 2026
Multiple active malware campaigns are delivering **remote access trojans (RATs)** using deceptive lures and multi-stage execution chains designed to evade endpoint defenses. Malwarebytes reported a campaign dubbed **DEAD#VAX** that distributes a file masquerading as a “PDF” but actually delivered as a **virtual hard disk (`.vhd`)** hosted via **IPFS**; when opened, Windows mounts the VHD and the victim is tricked into launching a **Windows Script File (`.wsf`)** that ultimately deploys **AsyncRAT**. The chain includes anti-analysis checks and **process injection** into Microsoft-signed binaries such as `RuntimeBroker.exe`, `OneDrive.exe`, `taskhostw.exe`, and `sihost.exe`, enabling hands-on-keyboard remote control while minimizing obvious on-disk artifacts. Separately, reporting described **DesckVB RAT v2.9**, a modular **.NET** RAT using an obfuscated **WSH JavaScript** stager followed by **PowerShell**-based anti-analysis checks and an in-memory (“fileless”) loader, emphasizing persistence and a plugin-based architecture for post-compromise capabilities. Another campaign distributes **ValleyRAT** disguised as a legitimate *LINE* installer, targeting **Chinese-speaking users**; it attempts to weaken defenses by using PowerShell to add broad **Windows Defender exclusions**, performs sandbox checks (e.g., mutex/file-locking behaviors), and uses advanced injection (reported as **PoolParty Variant 7** via Windows I/O completion ports) to hide within trusted processes while stealing credentials and maintaining C2 communications.
Jun 29, 2026