Large-Scale Campaign Distributing AsyncRAT via ScreenConnect

Security researchers have identified a large-scale malware distribution campaign leveraging search engine optimization (SEO) techniques to promote over 90 spoofed websites. These sites masquerade as legitimate software portals for popular utilities such as OBS Studio, DNS Jumper, and DS4Windows. Victims downloading these installers are infected with a hidden ScreenConnect remote access service, which threat actors subsequently use to deploy the AsyncRAT Trojan.

The attack chain utilizes sophisticated techniques, including DLL sideloading of a legitimate Microsoft binary and process hollowing into RegAsm.exe to evade detection. By leveraging signed, legitimate remote administration tools, the attackers successfully bypass many corporate allowlisting policies. This campaign has a global footprint, with landing pages localized in 10 languages, targeting both individual users and enterprise environments.

This activity represents a high risk to organizational security as it provides attackers with persistent, legitimate remote access that can be used for credential theft, lateral movement, or the deployment of secondary payloads.