Curated threat intel for security leaders
research 2026-08-31

ValleyRAT Malware Disguised as Adware

ValleyRAT Malware Disguised as Adware

The ValleyRAT malware has successfully evaded detection by masquerading as adware, compromising an estimated 100,000+ devices worldwide.

Bottom line: The ValleyRAT malware has successfully evaded detection by masquerading as adware, compromising an estimated 100,000+ devices worldwide.

What's happening: Threat actors are distributing the ValleyRAT backdoor via infected Adobe Flash Player installations, which are then bundled with malicious software updates from untrusted sources.

What to do: Security teams should prioritize monitoring for suspicious activity on Adobe Flash Player installations, and ensure all devices are updated to the latest version (CVE-2021-51100) to mitigate the risk of infection.

Source: Securelist (Kaspersky)