Ethical Hacking News
AsyncRAT: A Malware Menace Leveraging ScreenConnect Remote Access Tool for Mass Deployment
The AsyncRAT malware is being used by threat actors to exploit users via ScreenConnect remote access tool. Kaspersky has identified a "massive, multi-domain, multi-language" campaign using spoofed websites and malicious installer archives. The attackers are masquerading popular software installers, including OBS Studio and DS4Windows. The malware bundles legitimate Microsoft files with rogue DLLs to deploy ScreenConnect service. The ScreenConnect service executes a PowerShell script that configures Microsoft Defender exclusions and disables UAC prompts. The malware establishes a connection to a remote server, allowing threat actors to control infected systems and steal sensitive data. Robust cybersecurity measures are necessary to protect individuals and organizations from falling prey to these attacks.
The cybersecurity landscape has recently witnessed a significant threat actor exploiting the ScreenConnect remote access tool to deploy and execute the AsyncRAT malware, posing a substantial risk to individuals and organizations worldwide. Kaspersky, a renowned Russian cybersecurity company, has identified this malicious activity as part of a "massive, multi-domain, multi-language" campaign designed to distribute malicious installer archives hosted on spoofed websites.
These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam, among others. The attackers have set up over 90 domain names localized across 10 languages, including English, Russian, Chinese, German, French, Spanish, Portuguese, and Arabic. Some of these domains were established between August 2025 and March 2026.
The malicious archives bundle a legitimate, signed Microsoft install.exe binary alongside a rogue install.res.1033.dll library. This combination is loaded onto the device via DLL side-loading and deploys the ScreenConnect service, which awaits further instructions from the threat actors. Once ScreenConnect is up and running, the service creates and executes a PowerShell script ("Fj5NmEsp9EuKrun.ps1"), which configures Microsoft Defender exclusions, disables User Account Control (UAC) prompts, and then creates a Visual Basic Script (VBScript) file called "installer_method3_stream.vbs."
The script triggers the execution of "script.vbs," a script that's responsible for terminating all active PowerShell processes and running "cap.ps1" in a hidden window. The primary goal of the PowerShell script is to read the contents of the "secret_bytes.txt" file, extract from it the AsyncRAT module, and run it using process hollowing.
The malware then establishes a connection to a remote server ("mora1987.work[.]gd"), allowing the threat actor to covertly control infected Windows systems, steal sensitive data, and monitor user activity by recording screen content. Persistence is established by means of a scheduled task ("MasterPackager.Updater") that's activated every two minutes to execute "script.vbs," ensuring that the entire attack is run after a system reboot.
The attackers leverage search engine optimization techniques to push these sites to the top of search results in engines like Google and Bing. Kaspersky warned that the threat actor disguises ScreenConnect as popular utilities and distributes it through fraudulent websites that mimic official product pages.
This malicious campaign has significant implications for individuals and organizations, highlighting the importance of staying vigilant against such threats and adopting robust cybersecurity measures to protect themselves from falling prey to these attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Rise-of-AsyncRAT-A-Malware-Menace-Leveraging-ScreenConnect-Remote-Access-Tool-for-Mass-Deployment-ehn.shtml
https://thehackernews.com/2026/07/seo-poisoned-software-sites-abuse.html
Published: Wed Jul 1 18:42:21 2026 by llama3.2 3B Q4_K_M
