Loading story…
A phishing campaign delivers AsyncRAT through a socially engineered batch file named Right-click to open Invoice Details.bat. Hidden PowerShell decodes fragmented Base64 content, removes junk characters, and applies XOR decoding to write a renamed legitimate AutoIt interpreter, an AutoIt loader, and an encrypted extensionless payload into a randomly named temporary directory. The batch file also creates user-level persistence by placing h73la8.bat in the Windows Startup folder.
The AutoIt loader decrypts the payload solely in memory and injects it into Microsoft-signed charmap.exe using OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The injected multi-stage .NET loader decrypts Veukuzmw.dll, enabling AsyncRAT remote commands, information theft, screen capture, and TCP C2 communications with 158.51.122.136:4944; researchers also observed CLR and AMSI hooks, including an AMSI bypass, and an implanted PE with no corresponding file on disk.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Point Wild Threat Intelligence observed a five-stage, phishing-led AsyncRAT delivery chain using the “Right-click to open Invoice Details.bat” lure. The chain establishes Startup-folder persistence, decrypts its payload in memory, injects AsyncRAT into Microsoft-signed charmap.exe, patches AMSI, and communicates with 158.51.122.136:4944.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcepointwild.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported an **AsyncRAT** malware campaign that used phishing emails and HTML smuggling to deliver malicious ISO images while bypassing traditional network inspection. The lures arrived as HTML attachments disguised as receipts or order confirmations, with embedded JavaScript reconstructing a Base64-encoded ISO directly in the victim’s browser instead of downloading it from a remote server. Researchers said the activity was active from at least September 2021 and in some cases also used drive-by delivery, with the technique helping the attackers evade sandboxes, proxies, firewalls, and many antimalware engines for months. When victims opened the mounted ISO on Windows, it exposed a `.bat` or `.vbs` file that launched PowerShell, fetched or unpacked additional stages, established persistence, and executed .NET components in memory before deploying **AsyncRAT** and in some cases **NJRAT**. The campaign used multiple defense-evasion measures, including antivirus checks, Windows Defender exclusions, UAC bypass, disabling Action Center notifications, reflective DLL loading, and process injection into legitimate binaries such as `aspnet_compiler.exe` and `MSBuild.exe`; researchers also linked earlier variants to crypter-as-a-service tools including **HCrypt** and **Alosh** and warned of follow-on risks including credential theft and data exfiltration.
Aug 15, 2026
Threat actors are using fake AI study guides, developer tools, and other AI-themed decoys to infect Windows systems with a multi-stage malware chain that ends in **AsyncRAT** and a second remote access trojan tracked as **clay_Client**. Fortinet reported that victims receive booby-trapped archives containing a malicious `.lnk` file alongside hidden lure content; when opened, the shortcut launches a deeply staged sequence using PowerShell, VBS, scheduled tasks, repurposed AutoHotkey binaries, process hollowing, and reflective .NET loading while displaying a benign decoy document to reduce suspicion. The campaign hides payload data inside files disguised as PDFs and masks persistence as **Realtek** or Windows audio diagnostic components, including scheduled tasks that resemble legitimate audio services. Researchers said the malware establishes command-and-control, gathers host information, and supports remote desktop and fileless execution, with observed infrastructure including `shampobiskworld.nl`, `shampoolagtto.com`, `shamppocosmaticso.com`, and `107.172.10.190`. Fortinet also noted Chinese-language comments, mythology-based aliases, and other artifacts that may indicate AI-assisted malware development, and urged defenders to monitor PowerShell activity, audit scheduled tasks, scan memory, restrict unsanctioned scripting engines, and watch outbound connections for related indicators.
Aug 11, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026