Ankura CTIX FLASH Update – September 1, 2026

Malware Activity

Trusted Software Abuse and Social Engineering Drive New Enterprise Malware Threats

Cybersecurity researchers have identified two (2) dangerous malware campaigns that rely on deception rather than traditional malware delivery methods. The first is linked to the Silver Fox threat group. They disguise the ValleyRAT backdoor as a legitimate, digitally signed Chinese adware application called QN Wallpaper. This tricks users into trusting and even excluding it from antivirus protection. Once installed, ValleyRAT can steal keystrokes, screenshots, and clipboard data, disable Windows Defender, download additional malware, and provide attackers with full remote access. In a separate campaign, Microsoft uncovered TerminalFix. TerminalFix represents the next generation of the ClickFix social engineering technique. It uses spoofed Cloudflare CAPTCHA prompts to persuade users to run malicious PowerShell commands within Windows Terminal, ultimately enabling system compromise.