ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites — Threadlinqs Intelligence
As of 2026-07-01, ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 55 indicators of compromise.
Threat ID: TL-2026-1040 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Since October 2025, an unattributed threat actor has run a large-scale SEO-poisoning campaign across 90+ fraudulent, localized websites spoofing 25+ popular free tools (OBS Studio, VLC, DS4Windows,
The campaign begins with SEO-optimized, hreflang-tagged fake download portals (10+ localized languages: English, Russian, Chinese, German, French, Spanish, Arabic, and others) that impersonate 25+ legitimate freeware titles including OBS Studio, DNS Jumper, DS4Windows, Bandicam, Process Hacker, Glary Utilities, tModLoader, Defender Control, CrosshairX, VLC Media Player, KM Player, and LibreOffice. The pages use fabricated Schema.org ratings and distinct analytics/verification IDs to compartmentalize infrastructure and inflate search-result trust signals.
Victims download an archive containing a legitimate, Microsoft-signed `install.exe` alongside a malicious sideloaded library `install.res.1033.dll`, plus an Assets folder holding both the real requested freeware and a ScreenConnect (ConnectWise) remote-access installer disguised as MSI packages named `vcredist_x64.dll` / `vcredist_x86.dll`. Execution triggers a PowerShell script (`Fj5NmEsp9EuKrun.ps1`) that adds broad Microsoft Defender exclusions (all drives, system directories, RegAsm.exe) and flips the `ConsentPromptBehaviorAdmin` registry value to 0 to silently bypass UAC.
A VBScript dropper (`installer_method3_stream.vbs`) stages further payloads into `C:\Users\Public`, invoking `script.vbs`, which in turn triggers an obfuscated PowerShell stage (`cap.ps1`). That script parses `secret_bytes.txt` for `[SXX-` -tagged byte sequences, XOR-decrypts them (key 0xA7), reverses bit order, and reflectively loads the resulting .NET injector entirely in memory — leaving no dropped executable for static scanners. The in-memory injector performs process hollowing (T1055.012) into a suspended `RegAsm.exe` process to inject a non-stock AsyncRAT build that includes a cryptocurrency clipper, a dynamic runtime plugin-loading framework, and geofencing logic that avoids victims geolocated in the Middle East, North Africa, and Central Asia.
Persistence is established via a Scheduled Task (`MasterPackager.Updater`) that re-launches `script.vbs` every 2 minutes. ScreenConnect is configured against actor-controlled relay infrastructure (domains embedded in `system.config` XML: servermanagemen.xyz, r.manage-server.xyz, manageserver.xyz, winservec.net, cloudsynn.com, pingserv.pro, ehostservers.xyz, serverdnsplan.net), giving the operator an independent, dual-use legitimate RMM channel into the host alongside AsyncRAT's C2 (primary observed: mora1987.work.gd). Fake-software hosting is split across at least three infrastructure clusters (Dynu Systems/US, NOHAVPS LLC/US, dataforest GmbH/Germany), consistent with deliberate compartmentalization to survive partial takedowns. NCC Group and FOX-IT, working a related spike in ScreenConnect alerts, scoped a parallel/overlapping SEO-poisoning operation using the same ScreenConnect-abuse pattern to deploy a GPU cryptojacking payload, indicating the underlying distribution infrastructure/tooling is being reused or shared across multiple monetization payloads (AsyncRAT + cryptominer).
Target sectors: consumer, gaming, individual-users, corporate-networks, technology, finance
Target regions: North America, Europe, Asia, Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 55 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1566.002, T1583.001, T1587.001, T1588.002, T1059.001, T1059.005, T1059.007, T1204.002, T1202
