SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

Unknown threat actors are leveraging the ScreenConnect remote access tool to deploy and execute AsyncRAT as part of a massive, multi-domain, multi-language campaign. Kaspersky reported that malicious installer archives hosted on spoofed websites masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam. Over 90 domain names localized across 10 languages, including English, Russian, Chinese, German, French, Spanish, Portuguese, and Arabic, were identified, with some set up between August 2025 and March 2026.

The malicious archives bundle a legitimate, signed Microsoft install.exe binary alongside a rogue install.res.1033.dll library. Through DLL side-loading, the ScreenConnect service is deployed and awaits further instructions from the threat actors, allowing them to maintain control over compromised endpoints. Victims range from individual users to organizations.

Once ScreenConnect is active, it creates and executes a PowerShell script that configures Microsoft Defender exclusions, disables User Account Control prompts, and creates a VBScript file. This script generates five files in the C:UsersPublic directory and triggers execution of a script that terminates active PowerShell processes and runs a PowerShell script in a hidden window. The PowerShell script reads secret_bytes.txt, extracts the AsyncRAT module, and runs it using process hollowing.

The malware establishes a connection to a remote server (mora1987.work[.]gd), enabling covert control of infected Windows systems, data theft, and screen monitoring. Persistence is achieved via a scheduled task (MasterPackager.Updater) that executes every two minutes. The attackers use SEO techniques to push fraudulent sites to the top of search results in Google and Bing.