Fake Google Chrome Sites Are Spreading ValleyRAT Malware via DLL Hijacking

Cybercriminals continue to manipulate user trust by targeting those who search for Google Chrome downloads. A new cyberattack campaign distributes a powerful Remote Access Trojan (RAT) called ValleyRAT through fake Chrome download websites, using DLL hijacking techniques to silently infect devices. This ValleyRAT malware is a significant threat, capable of compromising targeted systems.

Who Is Behind the Attack?

Researchers attribute this campaign to a threat actor known as Silver Fox, previously linked to malware strains like Gh0st RAT and Purple Fox. While these attacks initially focused on Chinese-speaking regions such as Hong Kong, Taiwan, and Mainland China, similar methods could easily spread to other regions.

How the Infection Works

Here’s a breakdown of the attack sequence:

1. Fake Chrome Website: Cybercriminals create malicious websites that closely mimic the official Google Chrome download page.
2. ZIP Download: These sites trick users into downloading a ZIP archive containing a Setup.exe file.
3. Execution and Payload Delivery: When the user runs the setup file:
   • The installer checks for administrator access.
   • It proceeds to download four additional files, including a legitimate Douyin app (the Chinese version of TikTok) and two malicious DLLs: tier0.dll and sscronet.dll.
4. DLL Hijacking in Action: The attackers exploit DLL search order hijacking by placing their malicious DLLs alongside trusted applications. As a result, Windows unknowingly loads the attacker’s files instead of the legitimate ones.
5. ValleyRAT Deployment: This process activates the ValleyRAT malware in the background.

What ValleyRAT Can Do

ValleyRAT doesn’t just infect a device—it gives attackers broad control. Once installed, it can:

• Monitor screen activity
• Record keystrokes to steal sensitive information
• Maintain persistence to survive reboots and logouts
• Communicate with a remote command server
• Download and run additional malicious files

Moreover, the sscronet.dll component actively shuts down specific running processes, likely to disable antivirus software or other protections.

How to Stay Protected

Although threats like ValleyRAT are advanced, you can take steps to stay safe. Consider the following best practices:

• Always download software from official websites, such as https://www.google.com/chrome/.
• Avoid clicking on ads or unfamiliar links when searching for downloads.
• Verify file types and digital signatures before opening anything.
• Invest in endpoint protection that detects unusual behavior, like DLL injection.
• Train your staff regularly on cyber hygiene and social engineering tactics.

Final Thoughts

Attackers continue to evolve their methods, combining social engineering with technical exploits like DLL hijacking. Therefore, cybersecurity awareness remains one of your best defenses.

If your organization handles sensitive data or operates in a high-risk industry, now is the time to review your protection strategies.

Do you want help assessing your cybersecurity posture? Contact us today for a free consultation.