Large-Scale Campaign Using Masked ScreenConnect to Deploy AsyncRAT

Security researchers have uncovered a massive campaign leveraging fraudulent websites to distribute a malicious ScreenConnect implementation. By mimicking official download pages for popular utilities such as OBS Studio, DS4Windows, and DNS Jumper, the attackers use search engine optimization (SEO) techniques to trick users into downloading trojanized archives.

Technically, the attack utilizes DLL sideloading of a rogue library into a legitimate Microsoft executable to silently install ScreenConnect as a background service. Once active, the remote management tool is used to execute multi-stage PowerShell and VBScripts that perform defense evasion, establish persistence via scheduled tasks, and finally inject the AsyncRAT payload into the RegAsm.exe process.

This campaign represents a significant risk to both consumers and corporate environments, as it abuses signed, legitimate remote administration tools that are often allowlisted by security policies. The infrastructure is global, with localized sites in at least 10 languages and dozens of command-and-control (C2) domains active since October 2025.