SilverFox ValleyRAT Campaign Uses Eight-Stage Chain to Deploy Kernel Rootkit

### Executive summary Security researchers report an active SilverFox campaign deploying a highly sophisticated ValleyRAT variant via trojanized signed installers and an eight-stage kill chain that includes DLL sideloading, steganographic payload delivery, privilege escalation, fileless Donut shellcode execution, and installation of a kernel-level rootkit. The malware provides persistent, evasive capabilities (disabling telemetry/AMSI, rapid polymorphism, daily file-path rotation), supports plugin delivery over named pipes, and targets cryptocurrency clipboard data and Telegram credentials, making detection, hunting, and remediation especially difficult.