Loading story…
Researchers reported an AsyncRAT malware campaign that uses Cloudflare free-tier infrastructure and TryCloudflare tunneling domains to deliver a multi-stage infection chain while blending into legitimate traffic. The activity begins with phishing emails linking to Dropbox-hosted ZIP archives that contain double-extension Internet Shortcut files such as .pdf.url; when opened, those files trigger Windows Script Host content retrieved from TryCloudflare-hosted WebDAV shares. The malware then downloads batch files, installs an embedded Python environment, fetches additional payloads, and launches a Python-based injector that decrypts and injects AsyncRAT shellcode into explorer.exe, while a decoy PDF is opened to reduce user suspicion.
Additional reporting said the operators reused a delivery pattern seen in earlier AsyncRAT activity, again relying on Python tooling and Cloudflare-backed infrastructure to complicate detection and takedown. In some variants, the attackers mounted the remote WebDAV share directly to retrieve Python libraries instead of downloading them from python.org, and they established persistence through batch files placed in the Windows Startup folder. Investigators linked the campaign to TryCloudflare domains and an upstream server at 87.106.191.217:5380, underscoring how commodity remote-access malware tracked by MITRE ATT&CK as S0695 continues to evolve through low-cost cloud services and staged payload delivery.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Forcepoint published reporting on AsyncRAT malware delivery using Python and TryCloudflare, indicating renewed abuse of that infrastructure for malware staging and execution.
TrendAI analyzed a multi-stage campaign in which threat actors used phishing emails with Dropbox links, TryCloudflare-hosted WebDAV infrastructure, and Cloudflare free-tier services to deliver AsyncRAT. The infection chain used double-extension .pdf.url files, staged scripts and batch files, installed an embedded Python environment, and injected AsyncRAT shellcode into explorer.exe.
MITRE ATT&CK catalogs AsyncRAT as malware/software S0695, establishing a reference for the remote access trojan later seen in the campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourceforcepoint.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported multiple active malware operations abusing **Cloudflare infrastructure**, WebDAV shares, and legitimate **Python** runtimes to deliver remote-access trojans and stealers through multi-stage infection chains. In the **SERPENTINE#CLOUD** activity, attackers used invoice-themed lures aimed primarily at German-speaking businesses, including spoofed DATEV documents delivered via `trycloudflare.com` tunnels exposing WsgiDAV servers. Victims were led through LNK, WSH, WSF, BAT, and URL shortcut stages before portable Python environments, shellcode loaders, and process injection into `explorer.exe` launched malware including **AsyncRAT, XWorm, DcRat, VenomRAT, Violet v5, PureHVNC, PureCrypter**, and the custom **PhilliVio** RAT. Researchers tied the campaign to at least 27 Cloudflare tunnel domains, persistent C2 infrastructure across multiple countries, and repeated operator OPSEC failures such as leaked builder hostnames and reusable metadata.
Jun 29, 2026
Threat actors are abusing Cloudflare’s free hosting and tunneling services to make malicious infrastructure appear legitimate and evade filtering. Trend Micro reported an **AsyncRAT** campaign that uses **TryCloudflare** tunnel domains to stand up attacker-controlled **WebDAV** servers, effectively masking command-and-control and payload staging behind Cloudflare-trusted traffic. The infection chain starts with phishing emails containing **Dropbox** links to invoice-themed ZIP archives; the ZIPs include a deceptive double-extension **Internet Shortcut** (`.url`) that points to the WebDAV resource and triggers a multi-stage execution flow while opening a legitimate PDF as a decoy. The campaign also downloads legitimate Python components from official sources to establish a local Python environment used in later stages. Separately, a long-lived fake “Fast Ray VPN” review site hosted on **Cloudflare Pages** (`fast-ray-vpn.pages.dev`) was observed redirecting users via tracking-heavy URLs to third-party domains associated with affiliate/traffic-broker style distribution. The “Download” links did not deliver a VPN client; instead, users were funneled to generic “Your File Download Is Ready!” pages and, in at least one observed path, were ultimately served `OperaSetup.exe`—legitimate software delivered through deceptive pretext, consistent with **PUA**/misleading distribution tactics rather than a conventional short-lived phishing page.
Jul 2, 2026
Security researchers reported an **AsyncRAT** malware campaign that used phishing emails and HTML smuggling to deliver malicious ISO images while bypassing traditional network inspection. The lures arrived as HTML attachments disguised as receipts or order confirmations, with embedded JavaScript reconstructing a Base64-encoded ISO directly in the victim’s browser instead of downloading it from a remote server. Researchers said the activity was active from at least September 2021 and in some cases also used drive-by delivery, with the technique helping the attackers evade sandboxes, proxies, firewalls, and many antimalware engines for months. When victims opened the mounted ISO on Windows, it exposed a `.bat` or `.vbs` file that launched PowerShell, fetched or unpacked additional stages, established persistence, and executed .NET components in memory before deploying **AsyncRAT** and in some cases **NJRAT**. The campaign used multiple defense-evasion measures, including antivirus checks, Windows Defender exclusions, UAC bypass, disabling Action Center notifications, reflective DLL loading, and process injection into legitimate binaries such as `aspnet_compiler.exe` and `MSBuild.exe`; researchers also linked earlier variants to crypter-as-a-service tools including **HCrypt** and **Alosh** and warned of follow-on risks including credential theft and data exfiltration.
Aug 15, 2026