Loading story…
LevelBlue Labs has identified a campaign where attackers use compromised ConnectWise ScreenConnect clients to deploy AsyncRAT via fileless techniques. The attack chain involves VBScript and PowerShell loaders, in-memory execution of obfuscated .NET assemblies, and persistence through a fake 'Skype Updater' scheduled task. AsyncRAT is used for credential theft, keylogging, browser data exfiltration, and maintaining stealthy persistence.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityaffairs.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Huntress identified a campaign in which attackers use social engineering—including fake technical support, phishing, fraudulent refund-search results, and Quick Assist abuse—to persuade victims to install trojanized ConnectWise ScreenConnect clients. Rather than exploiting a ScreenConnect vulnerability, the altered remote-support software detects incoming sessions and uses ScreenConnect file-transfer and remote-execution functions to send a staged four-part VBScript loader to the connecting endpoint, potentially infecting technician and help-desk systems without further user interaction. The payload chain profiles hosts, establishes persistence, seeks elevated execution, and can deploy remote-access, tunneling, and cryptocurrency-mining tools while attempting to evade security controls, including Microsoft Defender reporting and User Account Control. Huntress observed the activity at unrelated organizations during late-August incidents and advises organizations to reimage confirmed compromised systems, review ScreenConnect deployments and audit logs, and investigate suspicious Windows Script Host or PowerShell execution linked to ScreenConnect sessions.
Sep 8, 2026
Threat actors are using fake AI study guides, developer tools, and other AI-themed decoys to infect Windows systems with a multi-stage malware chain that ends in **AsyncRAT** and a second remote access trojan tracked as **clay_Client**. Fortinet reported that victims receive booby-trapped archives containing a malicious `.lnk` file alongside hidden lure content; when opened, the shortcut launches a deeply staged sequence using PowerShell, VBS, scheduled tasks, repurposed AutoHotkey binaries, process hollowing, and reflective .NET loading while displaying a benign decoy document to reduce suspicion. The campaign hides payload data inside files disguised as PDFs and masks persistence as **Realtek** or Windows audio diagnostic components, including scheduled tasks that resemble legitimate audio services. Researchers said the malware establishes command-and-control, gathers host information, and supports remote desktop and fileless execution, with observed infrastructure including `shampobiskworld.nl`, `shampoolagtto.com`, `shamppocosmaticso.com`, and `107.172.10.190`. Fortinet also noted Chinese-language comments, mythology-based aliases, and other artifacts that may indicate AI-assisted malware development, and urged defenders to monitor PowerShell activity, audit scheduled tasks, scan memory, restrict unsanctioned scripting engines, and watch outbound connections for related indicators.
Aug 11, 2026