Fake Chrome sites spread ValleyRAT via DLL hijacking, targeting finance and sales with keylogging and remote execution.