Unknown threat actors have been leveraging the ScreenConnect remote access tool as a delivery mechanism for AsyncRAT, deploying the malware through a sprawling, SEO-poisoned campaign that spans dozens of spoofed websites and multiple languages. Security researchers at Kaspersky have identified more than 90 fraudulent domains, localized across ten languages including English, Russian, Chinese, German, French, Spanish, Portuguese, and Arabic, with some domains registered as early as August 2025 and as recently as March 2026. The campaign is notable for its scale, its abuse of search-engine optimization techniques to push malicious sites to the top of search results on Google and Bing, and its use of legitimate software installers as camouflage.
Fake Software Installers Deliver AsyncRAT via DLL Side-Loading
The attack begins when a user searches for popular software such as OBS Studio, DNS Jumper, DS4Windows, or Bandicam and lands on a spoofed website that mimics an official product page. The downloaded archive contains a legitimate, signed Microsoft install.execodecodecodecodecodecode binary bundled alongside a rogue install.res.1033.dllcodecodecodecodecodecode library. When the installer runs, the malicious DLL is loaded onto the device through a DLL side-loading technique, which then deploys the ScreenConnect service. This service waits for further instructions from the threat actors, effectively handing over remote control of the compromised endpoint.
How the Attack Chain Unfolds After Initial Execution
Once ScreenConnect is active, the service creates and executes a PowerShell script named Fj5NmEsp9EuKrun.ps1codecodecodecodecodecode. This script performs several critical actions: it configures exclusions in Microsoft Defender to avoid detection, disables User Account Control (UAC) prompts, and creates a VBScript file called installer_method3_stream.vbscodecodecodecodecodecode. That VBScript, in turn, generates five files in the C:\Users\Publiccodecodecodecodecodecode directory:
- msgbox.txt
- secret_bytes.txt
- 1.vb
- cap.ps1
- script.vbs
The script triggers script.vbscodecodecodecodecodecode, which terminates all active PowerShell processes and runs cap.ps1codecodecodecodecodecode in a hidden window. The primary function of this PowerShell script is to read the contents of secret_bytes.txtcodecodecodecodecodecode, extract the embedded AsyncRAT module, and execute it using process hollowing, a technique that injects malicious code into a legitimate process to evade detection.
AsyncRAT Establishes Remote Control and Persistence
Once deployed, the AsyncRAT payload connects to a remote command-and-control server at mora1987.work[.]gdcodecodecodecodecodecode. This connection allows the threat actor to covertly control infected Windows systems, steal sensitive data, and monitor user activity by recording screen content. Persistence is maintained through a scheduled task named MasterPackager.Updatercodecodecodecodecodecode, which activates every two minutes to execute script.vbscodecodecodecodecodecode, ensuring the full attack chain reruns after a system reboot. Victims range from individual users to entire organizations, reflecting the broad reach of the SEO-poisoned search results.
What Makes This Campaign Distinctive
The use of ScreenConnect as a delivery vector is a significant departure from typical AsyncRAT distribution methods, which often rely on phishing emails or malvertising. By bundling the remote access tool with legitimate signed binaries, the attackers bypass initial security checks and gain a foothold that is difficult to detect with signature-based antivirus alone. The SEO element adds another layer of danger: users searching for familiar, trusted software are led directly to malicious sites that appear authoritative and relevant. Kaspersky described the operation as a “massive, multi-domain, multi-language” campaign, underscoring its global targeting and professional execution.
How to Protect Yourself Against SEO-Poisoned Software Sites
For users who may have downloaded software from an unofficial source or who suspect ScreenConnect has been installed without their knowledge, immediate action is necessary. Begin by reviewing the C:\Users\Publiccodecodecodecodecodecode directory for any of the five files listed above and checking for scheduled tasks named MasterPackager.Updatercodecodecodecodecodecode. Run a full system scan with a multi-layer endpoint protection solution that includes behavioral analysis and real-time threat detection, as traditional signature-based tools may miss the DLL side-loading technique. Ensure Microsoft Defender exclusions have not been tampered with by reviewing the Windows Security settings. Enable User Account Control again if it appears to be disabled, and change passwords for any accounts accessed from the compromised system, prioritizing email, financial, and corporate credentials. Enable two-factor authentication wherever possible to add an additional layer of defense. When downloading software in the future, always use the official publisher website or a trusted app store, and verify the domain name carefully before clicking any search result. A reputable no-log VPN service can help obscure your browsing activity, but it is not a substitute for verifying the legitimacy of download sources. If you manage systems for an organization, conduct a thorough review of any ScreenConnect instances that were not explicitly approved and audit PowerShell execution logs for the script names detailed in this report.
