ValleyRAT is a remote access trojan that provides backdoor access and data exfiltration capabilities, and researchers have tied its campaigns to Chinese sp

Debugging a web application is supposed to be the moment you catch bugs, not the moment an attacker catches you. Microsoft has published an official security advisory for CVE-2026-102870, titled…

Fareed Radzi recently blogged about a malware campaign observed earlier in June by Kasperskys GReAT team. The malware campaign embedded malicious code in VBScripts, which were distributed through WhatsApp DMs. The VBScript then dropped the legitimate Remote Monitoring and Management (RMM) tool Manag[...]

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

Cyber Incidents · IntelFusions threat intelligence

2026年7月・8月にESET製品が最も多く検出したマルウェアは詐欺サイトへのリンクまたは詐欺を目的とした文章が書かれているWordファイル「DOC/Fraud」でした。今回は日本を標的とするValleyRATの脅威も解説します。

Cybersecurity researchers at Kaspersky have uncovered a sophisticated campaign spreading the ValleyRAT backdoor across Asia by disguising the malware inside a legitimate, digitally signed adware application.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts Fire Ant Evolves: From Hypervisors to Trusted Infrastructure       Gryxa: The AI-Built Toolkit That Watches How You Remove It ValleyRAT masquerading as adware   […]

At a glance Campaign Counterfeit software-download / fake installer campaign Threat actor Consistent with Silver Fox (Yinhu); moderate-confidence, not nation-state Targets China-based operations and Chinese-speaking users; many sectors Delivery vector Spoofed vendor download sites serving trojanized installers Key capabilities Persistence, SYSTEM privilege abuse, Defender tampering, C2 Source Microsoft Defender Experts TL;DR Attackers built high-fidelity clones of popular software sites. Victims download fake software installers that quietly deploy malware.

Analyse technique publiée le 31 août 2026 par Pavel Bukhtenko sur Securelist (Kaspersky). L'investigation a débuté suite à la demande d'un client souhaitant faire analyser un fichier suspect (MD5 : c24e99f9437feacaa63766a3cde3fe3d), initialement classé comme adware.