Malware

clay_Client

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Threat actors have been disguising malware as AI study guides and developer resources to trick professionals into running a multi-stage attack...

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

It plants scheduled tasks disguised as Realtek audio services...

T1059Command and Scripting InterpreterEvidence1

The two files posing as Realtek components are really copies of AutoHotkey, a legitimate automation tool repurposed as an execution engine...

T1059.001PowerShellEvidence1

It plants scheduled tasks disguised as Realtek audio services and opens a clean decoy document, so the victim sees a harmless file while the PowerShell stages run silently.

T1204.002Malicious FileEvidence1

Inside the archive sits a shortcut (LNK) file and two hidden documents. Opening it triggers a chain of scripts...

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

It plants scheduled tasks disguised as Realtek audio services...

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

It plants scheduled tasks disguised as Realtek audio services...

T1055.012Process HollowingEvidence1

One branch rebuilds a hidden program from numbers in a fake manifest and uses process hollowing to run it inside a real .NET process.

Stealth

2 techniques

T1055.012Process HollowingEvidence1

One branch rebuilds a hidden program from numbers in a fake manifest and uses process hollowing to run it inside a real .NET process.

T1480.002Mutual ExclusionEvidence1

It first creates mutex IDG5FUAM3PSONBSInGIGSWSD to prevent repeated execution.

Credential Access

1 technique

T1056Input CaptureEvidence1

mousemove Input Mocking : Provisioned to parse mouse coordinates and simulate user input

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

it extracts basic information from victims and uploads it to a remote server, including win32_processor, Environment.UserName, ... OS version and build number ... the security appliance ... and the system time

T1518Software DiscoveryEvidence1

including ... the security appliance from query root\SecurityCenter2

Collection

2 techniques

T1056Input CaptureEvidence1

mousemove Input Mocking : Provisioned to parse mouse coordinates and simulate user input

T1113Screen CaptureEvidence1

RemoteDesktopSend Screen Exfiltration : Captures screenshots using Graphics.CopyFromScreen, scales and compresses the frame into a JPEG format ... and sends the raw bytes back to the C2

Command and Control

1 technique

T1219Remote Access ToolsEvidence1

The final recovered .NET file ... is a modular RAT... The main class functions as the RAT’s command handler.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

infosecurity magazine newsNews

Jun 11, 2026

Cybercriminals Use Fake AI Guides and Dev Tools to Spread AsyncRAT Mal - Infosecurity Magazine

A modular .NET remote access trojan delivered alongside AsyncRAT as part of the same staged attack chain.

fortinet threat research blogNews

Jun 11, 2026

Threat Actors Weaponize AI Hype to Deliver AsyncRAT | FortiGuard Labs

An obfuscated modular .NET RAT recovered from the campaign. It establishes a mutex, contacts hardcoded C2 domains, profiles the victim host, receives encrypted commands, supports remote desktop and screenshot capture, and includes fileless assembly loading and RunPE/process hollowing capabilities.

fortinet threat researchNews

Jun 11, 2026

Threat Actors Weaponize AI Hype to Deliver AsyncRAT | FortiGuard Labs

An obfuscated modular .NET RAT recovered from the staged infection chain. It uses a mutex to avoid duplicate execution, contacts hard-coded C2 domains, collects host and security-product information, receives encrypted commands, supports shutdown/self-delete/update, remote desktop and screenshot exfiltration, reflection-based in-memory assembly loading, and RunPE/process hollowing.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

clay_Client

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Threat actors have been disguising malware as AI study guides and developer resources to trick professionals into running a multi-stage attack...

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

It plants scheduled tasks disguised as Realtek audio services...

T1059Command and Scripting InterpreterEvidence1

The two files posing as Realtek components are really copies of AutoHotkey, a legitimate automation tool repurposed as an execution engine...

T1059.001PowerShellEvidence1

It plants scheduled tasks disguised as Realtek audio services and opens a clean decoy document, so the victim sees a harmless file while the PowerShell stages run silently.

T1204.002Malicious FileEvidence1

Inside the archive sits a shortcut (LNK) file and two hidden documents. Opening it triggers a chain of scripts...

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

It plants scheduled tasks disguised as Realtek audio services...

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

It plants scheduled tasks disguised as Realtek audio services...

T1055.012Process HollowingEvidence1

One branch rebuilds a hidden program from numbers in a fake manifest and uses process hollowing to run it inside a real .NET process.

Stealth

2 techniques

T1055.012Process HollowingEvidence1

One branch rebuilds a hidden program from numbers in a fake manifest and uses process hollowing to run it inside a real .NET process.

T1480.002Mutual ExclusionEvidence1

It first creates mutex IDG5FUAM3PSONBSInGIGSWSD to prevent repeated execution.

Credential Access

1 technique

T1056Input CaptureEvidence1

mousemove Input Mocking : Provisioned to parse mouse coordinates and simulate user input

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

T1518Software DiscoveryEvidence1

including ... the security appliance from query root\SecurityCenter2

Collection

2 techniques

T1056Input CaptureEvidence1

mousemove Input Mocking : Provisioned to parse mouse coordinates and simulate user input

T1113Screen CaptureEvidence1

RemoteDesktopSend Screen Exfiltration : Captures screenshots using Graphics.CopyFromScreen, scales and compresses the frame into a JPEG format ... and sends the raw bytes back to the C2

Command and Control

1 technique

T1219Remote Access ToolsEvidence1

The final recovered .NET file ... is a modular RAT... The main class functions as the RAT’s command handler.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

infosecurity magazine newsNews

Jun 11, 2026

Cybercriminals Use Fake AI Guides and Dev Tools to Spread AsyncRAT Mal - Infosecurity Magazine

A modular .NET remote access trojan delivered alongside AsyncRAT as part of the same staged attack chain.

fortinet threat research blogNews

Jun 11, 2026

Threat Actors Weaponize AI Hype to Deliver AsyncRAT | FortiGuard Labs

fortinet threat researchNews

Jun 11, 2026

Threat Actors Weaponize AI Hype to Deliver AsyncRAT | FortiGuard Labs

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.