Security2 distinct publishers3 min readPublished
Kaspersky traced one submitted installer to a modified Chinese wallpaper tool whose signed executable sideloads a malicious libcef.dll, and the same installer switches Windows Defender off before it ever runs.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The sideloaded library keeps the wallpaper tool from working. Every function libcef.dll exports is placed into an infinite sleep, so neither QnWallpaper.exe nor QnwPlayer.exe does what the original program exists to do, and the sample's advertising features stay inert while the infection chain runs [10][5]. Kaspersky notes a fallback: if that sleep is ever interrupted, the code loads the genuine library's functions into memory, provided it can find the original on the system [10]. This build never delivers on the pretext an administrator relies on when whitelisting software like this: keeping its useful features from being blocked [23].
Malicious execution begins in DllMain when the library loads [11]. A second entry point, an export named RunDLL, is present and never called by QnWallpaper; Kaspersky's reading is that the operators intended to invoke it by hand through rundll32, or through an executable that was not in the downloaded package [11]. Once running, the code checks whether the current user is in the Administrators group and relaunches with runas if not, then selects its payload by host process: a file called PeLoader inside QnWallpaper.exe, a resource in libcef.dll itself inside QnwPlayer.exe [12][13].
Sequencing is what complicates the exclusion-list story. Persistence lands first, through autorun entries for the wallpaper tool plus a file extension association and a matching file dropped in the Startup folder [6][24]. The installer then writes DisableAntiSpyware and only afterwards starts the signed binary [8]. Elevation via runas happens later still, inside the loaded DLL [12]. That Defender write is redundant on a host where the install directory is already excluded, but on any other host it removes the need for the operator to rely on user hygiene.
The scale figures are annual rather than campaign-specific. Kaspersky recorded more than 100,000 detections of ValleyRAT and associated malware across 2026 against more than 1,500 unique users, mostly in China and India, spanning all of the year's activity rather than this route [17]. Taking both floors at face value gives roughly 67 detections per affected user [18]. That ratio is what affiliate and ad-network distribution looks like from the detection side: the same loaders arriving repeatedly at the same machines. The adware route carries no victim count of its own, and the analysis rests on a single installer submitted by a customer [19].
The packaging points at volume rather than a named target. The installer varies its behaviour according to the two-letter suffix in its filename, which Kaspersky reads as misdirection, and the chain opens meeting.tencent.com as a decoy page [26][25]. Kaspersky tracked the same group in an earlier tax-themed campaign against organisations in India and Russia, a different wrapper around the same loading trick [21].
Ranked by verification strength, evidence, and original report placement.
The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions.
A client asked Kaspersky to analyse a file with MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to the detection database; it was initially classified as adware, but suspicious network activity prompted deeper analysis, which found it triggers an infection chain delivering the ValleyRAT backdoor.
The sample's advertising functionality does not even work; instead it triggers the infection chain.
Regardless of the file name, the installer deploys a modified Chinese desktop wallpaper management tool called QN Wallpaper (qnwallpaper[.]keansoft[.]cn) and adds it to the registry's autorun entries; the original version is genuine adware that delivers bundled partner apps and displays ad banners.
The QN Wallpaper modules and malicious components are unpacked to C:\Program Files\QNWallpaper\5.4.0.1662\<random string of letters and digits>.
After unpacking, the installer uses the DisableAntiSpyware registry key to disable Windows Defender and then launches QnWallpaper.exe.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 31, 2026
1 article · August 31, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
security
Silver Fox times ValleyRAT to India's GST deadline behind a real Microsoft signature1 distinct publisher
security
Kaspersky's CVE surge has two sources, and only one of them lands in the CVE count1 distinct publisher
security
ICS blocking rate hits a 2022 low, and the global average is now the least useful number1 distinct publisher
product
Anthropic wipes saved cards after infostealers copy Claude login sessions1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Checkable mechanics, single-vendor chain
Almost every detail this story turns on is one you could check on a machine yourself: a named MD5, a registry value, an install path with the version number in it, an export left sleeping. Kaspersky walks the chain end to end on Securelist. Nobody, though, has checked Kaspersky — The Hacker News is relaying the same research, and the one outside data point, Cato Networks' Japanese manufacturer case, arrives secondhand in a single sentence.
Family-wide numbers, a campaign of one
The only quantity tied to this campaign is the single file a customer sent in. The 100,000-plus detections and 1,500-plus users belong to all of 2026's ValleyRAT activity — The Hacker News says so plainly rather than letting the number do unearned work — and dividing them gives roughly 67 hits per user, which looks like repeat encounters across a narrow set of machines, not a wave sweeping through the adware channel.
The headline motive is a hypothesis
The self-whitelisting hook that gives this story its punch is Kaspersky's own 'may have chosen' — a plausible read of attacker reasoning, not a finding — and the group name comes attached to a geography-and-payload judgement rather than shared indicators. Against that, both accounts disclose their limits instead of burying them: one submitted file, year-wide numbers. Overstated at the framing layer, honest underneath.
Vendor research, vendor telemetry, vendor advice
The story starts with a customer asking Kaspersky to add a file to its detection database and ends with Kaspersky advising users never to whitelist software — the research, the counting instrument and the product being implicitly recommended all belong to one company. That does not make the analysis wrong; the file paths stand on their own. It does mean the incentive goes unbalanced, because the second account amplifies rather than audits.
Mechanics firm, scale unknown
I would defend the chain — installer to Defender shutdown to signed process to sideloaded library — because it is described in artifacts a defender can look for. I would hold the framing loosely: two accounts with one origin, an actor name resting on a judgement call, and the question that actually matters for an operator, how many machines ran this installer, left unanswered by design.