Kaspersky has documented a campaign delivering ValleyRAT — also tracked as Winos 4.0 — through QN Wallpaper, a real Chinese desktop application that bundles partner software and shows advertising banners.

Over 100,000 detections, affecting more than 1,500 unique users, predominantly in China and India, across 2026.

The delivery mechanism is a decision the victim made

QN Wallpaper is adware. Not malware — adware. It is annoying, it bundles things nobody asked for, and antivirus products flag it accordingly.

So users add it to their exclusion list to stop the warnings. Kaspersky's own advice is the direct inverse: avoid adding such software to your security solutions' exclusion lists, because that is the pathway.

This is the sixth version of the same story this site has written in a month, and it is the worst one. SPECTRE unlinked EDR callbacks. A signed driver could delete Defender at boot. Weedhack set its own Defender exclusions. PaperCut attackers deleted the logs.

Every comparable case this month needed the attacker to do something. Here the attacker does nothing: antivirus flags the adware, the user adds it to the exclusion list for a perfectly good reason — the alert was correct about genuinely annoying software — and the backdoor arrives later through the hole already made.

You cannot patch that, and awareness training that says "do not add exclusions" collides with a user whose machine keeps interrupting them.

How it runs

The signed QnWallpaper.exe loads a malicious libcef.dll dropped beside it — DLL side-loading. The signature on the executable is genuine. The application is genuine. Only the library next to it is not, and Windows will happily let a trusted process load it.

It is the same technique behind Sleepwalker and TerminalFix this month.

What ValleyRAT does once in

  • Captures keystrokes and clipboard contents, takes screenshots
  • Delivers additional malicious modules
  • Disables Windows Defender through registry modification
  • Persists via autorun entries
  • Escalates privilege using runas
  • Flags itself as a critical process, so that terminating it crashes the machine

ValleyRAT captures keystrokes and clipboard, takes screenshots, disables Windows Defender through the registry, and flags itself as a critical process — so terminating it crashes the machine. That last trick is not a defence against detection but against removal: an analyst who kills the process takes the whole system down, which buys the operator time and makes a nervous administrator hesitate.

Silver Fox is the attributed actor, based on geographic distribution and payload analysis. Kaspersky has previously tracked the group in tax-themed operations against organisations in India and Russia.

What to do

  • Audit your exclusion lists. Not for malware — for software somebody excluded to stop the noise. That list is an inventory of your intentional blind spots.
  • Do not exclude an application; exclude nothing. If a program cannot run without an exemption, that is information about the program.
  • Remove bundled adware rather than silencing the alert. The alert was correct.
  • Check for libcef.dll in unexpected directories, and for a QN Wallpaper install nobody remembers.
  • If a process cannot be terminated without a crash, treat that as the finding, not as an obstacle.

What is not established

  • How many of the 1,500 users came in through this specific route, as distinct from other ValleyRAT delivery.
  • Whether the signing certificate was compromised or fraudulently obtained. Kaspersky does not say.
  • Attack success rates.
  • Whether QN Wallpaper's publisher is aware or involved. Nothing reported either way.