Adware as a delivery channel

Silver Fox delivered ValleyRAT through signed adware that users whitelist themselves

Kaspersky traced one submitted installer to a modified Chinese wallpaper tool whose signed executable sideloads a malicious libcef.dll, and the same installer switches Windows Defender off before it ever runs.