InfoSecBulletin Cybersecurity for mankind
A new malware campaign targets users by misusing their trust in popular apps. Cybercriminals are spreading fake installers for Telegram, WinSCP, Google Chrome, and Microsoft Teams to install ValleyRat, a remote access trojan for long-term system takeover. The campaign has been attributed to the China-aligned APT group known as Silver Fox, which has remained active since at least 2022.
The infection starts when victims download fake application installers from spear-phishing emails or harmful ads. Users see a regular installation interface, but unseen processes run quietly in the background.
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
The malware organizes files, installs kernel-level drivers, interferes with endpoint security, and activates a ValleyRat beacon for ongoing access to the hacked system.
Nextron Systems security researchers identified this campaign through their detailed analysis of the entire infection chain.
The investigation found that attackers use various methods to avoid detection, including obfuscation, tampering with endpoint security, and kernel-level techniques to communicate with remote servers.
The distribution primarily occurs through trojanized Telegram installers. One analyzed sample, named tg.exe, carries the SHA-256 hash 9ede6da5986d8c0df3367c395b0b3924ffb12206939f33b01610c1ae955630d1.
Despite displaying a genuine Telegram Desktop 6.0.2 interface, closer inspection reveals notable inconsistencies.
The PE header timestamp is from 2019, and the first VirusTotal submission was in August 2025, indicating a strange six-year gap for a regularly updated application.
Infection Mechanism and Defense Evasion:
The installer saves files in C:\ProgramData\WindowsData\, including a renamed 7-Zip binary (funzip.exe) and an encrypted file disguised as main.xml.
The malware then uses PowerShell to add a Microsoft Defender exclusion for the entire C:\ drive, effectively silencing antivirus protection.
The archive extraction command reveals the embedded password:-
“C:\ProgramData\WindowsData\funzip.exe” x -y -phtLcENyRFYwXsHFnUnqK -o”C:\ProgramData\WindowsData” “C:\ProgramData\WindowsData\main.xml”
This extraction deploys men.exe, the main orchestrator that performs environmental reconnaissance by scanning for security processes, including Microsoft Defender’s MsMpEng.exe and Chinese security products like ZhuDongFangYu.exe and 360tray.exe.
The campaign maintains persistence using a scheduled task called WindowsPowerShell.WbemScripting.SWbemLocator, which imitates real Windows components. It runs an encoded VBScript that activates the ValleyRat beacon for ongoing system access.
