Fake Installer: Ultimately, ValleyRAT infection

February 3, 2026 · Cybereason · Severity: HIGH

Cybereason uncovered a fake installer campaign delivering ValleyRAT malware, a remote access trojan used for cyberespionage. The attackers disguised malicious payloads as legitimate software installers, tricking users into executing them. This technique targets individuals and organizations, enabling unauthorized access to compromised systems for data theft and surveillance. The attack highlights evolving tactics in malware distribution, with ValleyRAT leveraging undocumented methods to evade detection. Cybereason’s analysis provides new threat intelligence, helping defenders identify and mitigate such threats. Organizations should scrutinize software sources and deploy endpoint detection to prevent similar infections. The campaign underscores the risks of socially engineered attacks and the need for heightened vigilance.

Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them.

In this Threat Analysis report, Cybereason Security Services investigates a fake installer attack we recently observed multiple times. We identified some findings that have not been documented in previous reports and obtained new threat intelligence insights from the malwares.