{"id":61687,"date":"2026-07-01T15:42:29","date_gmt":"2026-07-01T19:42:29","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=61687"},"modified":"2026-07-01T15:42:29","modified_gmt":"2026-07-01T19:42:29","slug":"screenconnect-asyncrat-seo-poisoning-campaign","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/screenconnect-asyncrat-seo-poisoning-campaign\/","title":{"rendered":"SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT"},"content":{"rendered":"<p>Unknown threat actors have been leveraging the <a href=\"https:\/\/www.screenconnect.com\" target=\"_blank\" rel=\"sponsored noopener noreferrer\" data-iacss-external=\"1\">ScreenConnect<\/a> remote access tool as a delivery mechanism for <a href=\"https:\/\/github.com\/AsyncRAT\/AsyncRAT\" target=\"_blank\" rel=\"noopener noreferrer\" data-iacss-external=\"1\">AsyncRAT<\/a>, deploying the malware through a sprawling, SEO-poisoned campaign that spans dozens of spoofed websites and multiple languages. Security researchers at <a href=\"https:\/\/www.kaspersky.com\" target=\"_blank\" rel=\"noopener noreferrer\" data-iacss-external=\"1\">Kaspersky<\/a> have identified more than 90 fraudulent domains, localized across ten languages including English, Russian, <a href=\"https:\/\/overcentral.com\/en\/chinese-hackers-google-workspace-defense-emails\/\" title=\"Chinese hackers exploit Google Workspace to steal defense emails\" data-iacss-internal=\"1\">Chinese<\/a>, German, French, Spanish, Portuguese, and Arabic, with some domains registered as early as August 2025 and as recently as March 2026. The campaign is notable for its scale, its abuse of search-engine optimization techniques to push malicious sites to the top of <a href=\"https:\/\/overcentral.com\/en\/google-ai-search-opt-out-mechanism\/\" title=\"Google Allows Websites to Exclude Themselves from AI Search Results\" data-iacss-internal=\"1\">search results<\/a> on Google and Bing, and its use of legitimate software installers as camouflage.<\/p>\n<h2>Fake Software Installers Deliver AsyncRAT via DLL Side-Loading<\/h2>\n<p>The attack begins when a user searches for popular software such as OBS Studio, DNS Jumper, DS4Windows, or Bandicam and lands on a spoofed website that mimics an official product page. The downloaded archive contains a legitimate, signed Microsoft <code>install.exe<\/code>codecodecodecodecodecode binary bundled alongside a rogue <code>install.res.1033.dll<\/code>codecodecodecodecodecode library. When the installer runs, the malicious DLL is loaded onto the device through a DLL side-loading technique, which then deploys the ScreenConnect service. This service waits for further instructions from the threat actors, effectively handing over remote control of the compromised endpoint.<\/p>\n<h2>How the Attack Chain Unfolds After Initial Execution<\/h2>\n<p>Once ScreenConnect is active, the service creates and executes a PowerShell script named <code>Fj5NmEsp9EuKrun.ps1<\/code>codecodecodecodecodecode. This script performs several critical actions: it configures exclusions in Microsoft Defender to avoid detection, disables User Account Control (UAC) prompts, and creates a VBScript file called <code>installer_method3_stream.vbs<\/code>codecodecodecodecodecode. That VBScript, in turn, generates five files in the <code>C:\\Users\\Public<\/code>codecodecodecodecodecode directory:<\/p>\n<ul>\n<li>msgbox.txt<\/li>\n<li>secret_bytes.txt<\/li>\n<li>1.vb<\/li>\n<li>cap.ps1<\/li>\n<li>script.vbs<\/li>\n<\/ul>\n<p>The script triggers <code>script.vbs<\/code>codecodecodecodecodecode, which terminates all active PowerShell processes and runs <code>cap.ps1<\/code>codecodecodecodecodecode in a hidden window. The primary function of this PowerShell script is to read the contents of <code>secret_bytes.txt<\/code>codecodecodecodecodecode, extract the embedded AsyncRAT module, and execute it using process hollowing, a technique that injects malicious code into a legitimate process to evade detection.<\/p>\n<h2>AsyncRAT Establishes Remote Control and Persistence<\/h2>\n<p>Once deployed, the AsyncRAT payload connects to a remote command-and-control server at <code>mora1987.work[.]gd<\/code>codecodecodecodecodecode. This connection allows the threat actor to covertly control infected Windows systems, steal sensitive data, and monitor user activity by recording screen content. Persistence is maintained through a <a href=\"https:\/\/overcentral.com\/en\/dropping-elephant-googleerrorreport-malware\/\" title=\"Dropping Elephant Adds GoogleErrorReport Scheduled Task for Persistence\" data-iacss-internal=\"1\">scheduled task<\/a> named <code>MasterPackager.Updater<\/code>codecodecodecodecodecode, which activates every two minutes to execute <code>script.vbs<\/code>codecodecodecodecodecode, ensuring the full attack chain reruns after a system reboot. Victims range from individual users to entire organizations, reflecting the broad reach of the SEO-poisoned search results.<\/p>\n<h2>What Makes This Campaign Distinctive<\/h2>\n<p>The use of ScreenConnect as a delivery vector is a significant departure from typical AsyncRAT distribution methods, which often rely on phishing emails or malvertising. By bundling the remote access tool with legitimate signed binaries, the attackers bypass initial security checks and gain a foothold that is difficult to detect with signature-based antivirus alone. The SEO element adds another layer of danger: users searching for familiar, trusted software are led directly to malicious sites that appear authoritative and relevant. Kaspersky described the operation as a &#8220;massive, multi-domain, multi-language&#8221; campaign, underscoring its global targeting and professional execution.<\/p>\n<h2>How to Protect Yourself Against SEO-Poisoned Software Sites<\/h2>\n<p>For users who may have downloaded software from an unofficial source or who suspect ScreenConnect has been installed without their knowledge, immediate action is necessary. Begin by reviewing the <code>C:\\Users\\Public<\/code>codecodecodecodecodecode directory for any of the five files listed above and checking for scheduled tasks named <code>MasterPackager.Updater<\/code>codecodecodecodecodecode. Run a full system scan with a multi-layer endpoint protection solution that includes behavioral analysis and real-time threat detection, as traditional signature-based tools may miss the DLL side-loading technique. Ensure Microsoft Defender exclusions have not been tampered with by reviewing the Windows Security settings. Enable User Account Control again if it appears to be disabled, and change passwords for any accounts accessed from the compromised system, prioritizing email, financial, and corporate credentials. Enable two-factor authentication wherever possible to add an additional layer of defense. When downloading software in the future, always use the official publisher website or a trusted app store, and verify the domain name carefully before clicking any search result. A reputable no-log VPN service can help obscure your browsing activity, but it is not a substitute for verifying the legitimacy of download sources. If you manage systems for an organization, conduct a thorough review of any ScreenConnect instances that were not explicitly approved and audit PowerShell execution logs for the script names detailed in this report.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Unknown threat actors have been leveraging the ScreenConnect remote access tool as a delivery mechanism for AsyncRAT, deploying the malware through a sprawling, SEO-poisoned campaign that spans dozens of spoofed websites and multiple languages. Security researchers at Kaspersky have identified more than 90 fraudulent domains, localized across ten languages including English, Russian, Chinese, German, French, [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":84136,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/61687.png","fifu_image_alt":"SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT","footnotes":""},"categories":[349],"tags":[],"class_list":["post-61687","post","type-post","status-publish","format-standard","has-post-thumbnail","category-articles"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/61687.png","fifu_image_alt":"SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/61687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=61687"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/61687\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/84136"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=61687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=61687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=61687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}