Fake Installer: Ultimately, ValleyRAT infection

February 3, 2026 · Cybereason · Severity: HIGH

Cybereason Security Services has uncovered a fake installer campaign distributing ValleyRAT, a remote access trojan (RAT), through deceptive software installations. The attackers lure victims by disguising malicious payloads as legitimate software installers, such as popular applications or tools. Once executed, the installer deploys ValleyRAT, enabling unauthorized remote access to compromised systems. This campaign highlights the use of social engineering tactics to exploit user trust and deliver malware effectively. The attack targets individuals and organizations indiscriminately, posing a significant risk to both personal and enterprise environments. ValleyRAT is designed to steal sensitive information, execute commands, and maintain persistence on infected systems. Cybereason’s investigation revealed new insights into the malware’s behavior and infrastructure, including previously undocumented techniques used by the attackers. The campaign underscores the evolving sophistication of cybercriminal tactics and the importance of vigilance when downloading software. Organizations and individuals are advised to verify the authenticity of software sources, employ endpoint protection solutions, and educate users about phishing and social engineering risks. This incident serves as a reminder of the persistent threat posed by RATs and the need for proactive cybersecurity measures.

Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them.

In this Threat Analysis report, Cybereason Security Services investigates a fake installer attack we recently observed multiple times. We identified some findings that have not been documented in previous reports and obtained new threat intelligence insights from the malwares.