China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics

Security researchers uncovered an updated ValleyRAT campaign that uses an HFS-based downloader, multi-stage DLL sideloading, anti‑AV termination, and shellcode injection into svchost.exe to fetch and run the final ValleyRAT payload; separately, Fortinet reported a Spanish-targeted phishing chain delivering an updated Agent Tesla variant via Excel Add-In exploits (CVE-2017-0199/CVE-2017-11882) that loads PowerShell to retrieve the infostealer and keylogger.