Loading story…
Threat actors are using fake AI study guides, developer tools, and other AI-themed decoys to infect Windows systems with a multi-stage malware chain that ends in AsyncRAT and a second remote access trojan tracked as clay_Client. Fortinet reported that victims receive booby-trapped archives containing a malicious .lnk file alongside hidden lure content; when opened, the shortcut launches a deeply staged sequence using PowerShell, VBS, scheduled tasks, repurposed AutoHotkey binaries, process hollowing, and reflective .NET loading while displaying a benign decoy document to reduce suspicion.
The campaign hides payload data inside files disguised as PDFs and masks persistence as Realtek or Windows audio diagnostic components, including scheduled tasks that resemble legitimate audio services. Researchers said the malware establishes command-and-control, gathers host information, and supports remote desktop and fileless execution, with observed infrastructure including shampobiskworld.nl, shampoolagtto.com, shamppocosmaticso.com, and 107.172.10.190. Fortinet also noted Chinese-language comments, mythology-based aliases, and other artifacts that may indicate AI-assisted malware development, and urged defenders to monitor PowerShell activity, audit scheduled tasks, scan memory, restrict unsanctioned scripting engines, and watch outbound connections for related indicators.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Fortinet assessed that Simplified Chinese variable names, unsanitized Chinese comments, emoji annotations, and aliases derived from Chinese mythology suggested likely AI-assisted malware development. Researchers said generative AI may have accelerated development while a human operator still defined the attack logic.
A separate branch extracted another PowerShell stage that added Microsoft Defender exclusions for C:\ and powershell.exe, re-enabled Windows Script Host, restored .vbs associations, and used a reflective .NET loader targeting cvtres.exe. The final .NET RAT was AsyncRAT, which created the mutex IDG5FUAM3PSONBSInGIGSWSD, contacted command-and-control domains including shampobiskworld.nl, shampoolagtto.com, and shamppocosmaticso.com, and supported remote access, screenshots, updates, self-delete, and fileless execution.
Fortinet found that renamed legitimate AutoHotkey binaries were used as execution engines for malicious scripts, including branches that reconstructed payloads from disguised data files. One branch used process hollowing into legitimate .NET binaries such as AddInProcess32.exe, AppLaunch.exe, or aspnet_compiler.exe to launch an obfuscated clay_Client RAT payload.
The intrusion established persistence with scheduled tasks masquerading as Realtek audio services, including CheckRealtekAudioVersion, RealtekAudioEnhancements64, and ResetRealtekAudioSettings64. It also used batch, PowerShell, and VBS components to relaunch itself hidden and maintain redundant persistence.
Opening the malicious LNK triggered an obfuscated command chain that extracted encrypted content from a PDF-named file, decrypted it with PowerShell, and executed successive stages while displaying a benign decoy document. The malware wrote staged payloads under a fake WindowsSoundDiagnostics path and used native Windows tools to stay stealthy.
FortiGuard Labs observed a malware campaign targeting Microsoft Windows systems using AI-themed lure documents and archives, including fake guides about PostgreSQL 18, marketing in the age of AI, and agentic coding with Claude Code. The campaign used a compressed archive containing a malicious LNK file and hidden files to begin a multi-stage infection chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported an **AsyncRAT** malware campaign that used phishing emails and HTML smuggling to deliver malicious ISO images while bypassing traditional network inspection. The lures arrived as HTML attachments disguised as receipts or order confirmations, with embedded JavaScript reconstructing a Base64-encoded ISO directly in the victim’s browser instead of downloading it from a remote server. Researchers said the activity was active from at least September 2021 and in some cases also used drive-by delivery, with the technique helping the attackers evade sandboxes, proxies, firewalls, and many antimalware engines for months. When victims opened the mounted ISO on Windows, it exposed a `.bat` or `.vbs` file that launched PowerShell, fetched or unpacked additional stages, established persistence, and executed .NET components in memory before deploying **AsyncRAT** and in some cases **NJRAT**. The campaign used multiple defense-evasion measures, including antivirus checks, Windows Defender exclusions, UAC bypass, disabling Action Center notifications, reflective DLL loading, and process injection into legitimate binaries such as `aspnet_compiler.exe` and `MSBuild.exe`; researchers also linked earlier variants to crypter-as-a-service tools including **HCrypt** and **Alosh** and warned of follow-on risks including credential theft and data exfiltration.
Aug 15, 2026
Multiple active malware campaigns are delivering **remote access trojans (RATs)** using deceptive lures and multi-stage execution chains designed to evade endpoint defenses. Malwarebytes reported a campaign dubbed **DEAD#VAX** that distributes a file masquerading as a “PDF” but actually delivered as a **virtual hard disk (`.vhd`)** hosted via **IPFS**; when opened, Windows mounts the VHD and the victim is tricked into launching a **Windows Script File (`.wsf`)** that ultimately deploys **AsyncRAT**. The chain includes anti-analysis checks and **process injection** into Microsoft-signed binaries such as `RuntimeBroker.exe`, `OneDrive.exe`, `taskhostw.exe`, and `sihost.exe`, enabling hands-on-keyboard remote control while minimizing obvious on-disk artifacts. Separately, reporting described **DesckVB RAT v2.9**, a modular **.NET** RAT using an obfuscated **WSH JavaScript** stager followed by **PowerShell**-based anti-analysis checks and an in-memory (“fileless”) loader, emphasizing persistence and a plugin-based architecture for post-compromise capabilities. Another campaign distributes **ValleyRAT** disguised as a legitimate *LINE* installer, targeting **Chinese-speaking users**; it attempts to weaken defenses by using PowerShell to add broad **Windows Defender exclusions**, performs sandbox checks (e.g., mutex/file-locking behaviors), and uses advanced injection (reported as **PoolParty Variant 7** via Windows I/O completion ports) to hide within trusted processes while stealing credentials and maintaining C2 communications.
Jun 29, 2026
Researchers reported a large-scale **malware distribution campaign** that used fake software offerings hosted on trusted platforms to infect users, with operators increasingly relying on **AI-assisted or “vibe-coded” development** to scale payload creation. McAfee identified more than **443 malicious ZIP archives** masquerading as AI tools, game cheats, VPNs, drivers, and decryptors, distributed via services including *Discord*, *SourceForge*, *FOSSHub*, *MediaFire*, and *mydofiles.com*. The campaign used **48 variants** of `WinUpdateHelper.dll` across **17 kill chains**, each with separate command-and-control infrastructure but linked through shared cryptocurrency wallet credentials, allowing researchers to trace monetization activity and victim distribution across countries including the US, UK, India, Brazil, France, Canada, and Australia. A separate but related report described another **multi-stage malware campaign** that also relied on deceptive delivery and evasion, using **.NET Ahead-of-Time (AOT) compilation** to hinder analysis and a host-scoring system to avoid sandboxes and low-value targets. In that intrusion chain, a phishing-delivered ZIP launched `KeyAuth.exe`, which fetched `bound_build.exe` and then deployed both the **Rhadamanthys infostealer** and an **XMRig** miner disguised as *MicrosoftEdgeUpdater*. The malware checked conditions such as RAM, uptime, document count, and active antivirus processes, and terminated itself if the environment scored below a threshold, showing a deliberate effort to evade detection while maximizing successful infections.
Jun 29, 2026