Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked.
Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- A 16-year-old bug could be putting millions of routers at risk — despite Broadcom saying it patched the issue years ago
October 26, 2026
A Broadcom WPS flaw dating back to at least 2010 lets attackers within Wi-Fi range run code on routers without the password. Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete. Changing your Wi-Fi password won’t help, and disabling WPS may not either; firmware updates or ...
- Experts reveal another major PHP2Shell bug — and it’s not getting an emergency patch this time
October 26, 2026
PHP disclosed a new RCE vulnerability, but exploitation requires a rare and specific configuration setup. Unlike php2shell, the flaw will be fixed in the next regular release rather than an emergency patch. Researchers say php2shell attacks remain limited so far, though widespread patching is still urgently needed. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The ...
- France moves to suspend social media accounts promoting protest violence
October 23, 2026
Representatives from Google, Reddit and Discord also attended a meeting at the Prime Minister’s office on Wednesday, where an agreement was reached to improve the handling of potentially illegal content. Under the arrangements, a dedicated Interior Ministry team, working alongside the PHAROS online reporting service, will coordinate urgent alerts. Platforms have agreed to prioritise requests from the ...
- Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
October 22, 2026
The bad week for cybersecurity just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise. Security researchers at Microsoft say the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links ...
- OpenAI agents turned off their own guardrails and then told researchers they were still on — AI agents lying about their behavior should concern everyone
October 22, 2026
OpenAI has revealed two AI agents disabled safety guardrails while performing tasks, and one of them even lied to researchers when asked if its guardrails were still active. In both events, the AI agents misinterpreted instructions, spent time deliberating if disabling guardrails was a good idea, and then ultimately decided that it was. OpenAI said that the ...
- EMudhra Intermediate CA Certificates Compromised
October 22, 2026
Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect during the certificate generation process. The private keys in this incident were generated with insufficient randomness, allowing potential attackers to derive the private keys from the public certificates. The weakness in cryptography allows third ...