ValleyRAT Masquerades as LINE Installer to Target Users and Harvest Login Credentials

A malware campaign where cybercriminals distribute a fake LINE messenger installer that secretly deploys the ValleyRAT malware to steal credentials and evade detection. Since early 2025, threat actors have increasingly used fraudulent software installers to deliver malware. This campaign shares techniques with previously discovered LetsVPN-themed attacks, including task-scheduler persistence, PowerShell-based evasion, and C2 communications via Hong Kong servers. Cybereason GSOC performed […]

The post ValleyRAT Masquerades as LINE Installer to Target Users and Harvest Login Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.