AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access (SEO-Poisoned Fake Installer Sites) — Threadlinqs Intelligence
As of 2026-07-02, AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access (SEO-Poisoned Fake Installer Sites) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 44 indicators of compromise.
Threat ID: TL-2026-1081 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Since October 2025, unknown financially motivated actors have run a massive, multi-language SEO-poisoning campaign distributing over 90 typosquatted fake-installer websites impersonating OBS Studio,
Kaspersky's Managed Detection and Response (MDR) team escalated a single suspicious alert that unraveled a large-scale, multi-domain, multi-language campaign active since at least October 2025 (with domain registrations beginning around August 2025 and peaking in February 2026; activity paused at the end of March 2026, though many fraudulent pages remain live). The operators registered 90+ typosquatted domains across 10 languages (English, Russian, Chinese, German, French, Spanish, Portuguese, Arabic) impersonating legitimate free software — OBS Studio, DNS Jumper, Bandicam, DS4Windows, Process Hacker, Glary Utilities, Lossless Scaling, CrosshairX, Defender Control and 20+ others — and used SEO poisoning to push these sites to the top of Google and Bing search results.
Victims download an archive (e.g. obs-studio-windows-x64.zip) from hosts such as fileget.loseyourip.com or direct-download.giize.com. The archive bundles a legitimate, Microsoft-signed install.exe (MD5 87603ea025623b19954e460add532048) alongside a malicious install.res.1033.dll (17+ hash variants observed). When install.exe runs, Windows' DLL search-order behavior loads the rogue DLL (T1574.002), which silently installs a renamed ScreenConnect MSI (masquerading as vcredist_x64.dll) via `msiexec.exe /i ... /qn /norestart` (T1218.007) while the legitimate free software (masquerading as vcredist_x86.dll) installs normally as cover. ScreenConnect is abused specifically because it is commonly allowlisted under workplace security policies, letting the operators move around undetected once remote access is established (T1219).
Once ScreenConnect is live, it drops and executes Fj5NmEsp9EuKrun.ps1, which creates Microsoft Defender exclusions for system drives and specific processes and sets the registry value ConsentPromptBehaviorAdmin=0 to silently disable UAC prompts (T1548.002, T1562.001). A follow-on VBScript, installer_method3_stream.vbs, stages payload files into C:\Users\Public\ and launches script.vbs, which terminates PowerShell processes to cover tracks and launches cap.ps1 in hidden mode. cap.ps1 reads secret_bytes.txt, an XOR-encrypted (key 0xA7) and bit-inverted embedded PE, decrypts and reflectively loads it, then invokes ConsoleApp1.Module1.Run() via .NET reflection (T1027, T1140, T1106). This module spawns RegAsm.exe with CREATE_SUSPENDED and injects the decrypted AsyncRAT payload via process hollowing (T1055.012), giving the attacker a legitimate-looking process (RegAsm.exe, a Microsoft .NET utility) hosting the RAT.
Persistence is established with a scheduled task — `schtasks /Create /TN "MasterPackager.Updater" /TR "wscript.exe \"C:\Users\Public\script.vbs\"" /SC MINUTE /MO 2 /F` — that re-triggers the entire loader chain every two minutes, surviving reboots (T1053.005). The injected RegAsm process then calls back to AsyncRAT and ScreenConnect C2 infrastructure (e.g. mora1987.work.gd for AsyncRAT; servermanagemen.xyz, r.manage-server.xyz, winservec.net, manageserver.xyz, cloudsynn.com, pingserv.pro, ehostservers.xyz, serverdnsplan.net, pingpanl.pro, managedevice.xyz, edgeserv.ru for ScreenConnect), giving the operator an encrypted, persistent channel (T1573, T1071.001, T1105).
AsyncRAT is an open-source .NET RAT with keylogging (via SetWindowsHookEx, T1056.001), screen/audio capture (T1113, T1123), stored-credential/password recovery (T1555), remote shell, webcam access, and payload injection capabilities, plus built-in virtualization/sandbox evasion (T1497). The campaign's infrastructure spans at least two clusters: Cluster 1 (162.216.241.242, Dynu Systems US, hosting spoofed portals; 198.23.185.81, NOHAVPS LLC US, hosting malicious archives) and Cluster 2 (2.59.134.97, dataforest GmbH Germany, hosting both portals and download resources). Kaspersky assesses the campaign as moderately sophisticated — it relies on abusing legitimate, signed software and allowlisted remote-access tooling plus basic obfuscation rather than novel exploit development —
Target sectors: all sectors general consumer enterprise freeware users, gaming, technology, small business
Target regions: Global, North America, Europe, Asia, Middle East
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 44 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1189, T1204, T1059, T1059, T1106, T1053, T1053, T1548