{"id":1559,"date":"2026-07-01T19:07:01","date_gmt":"2026-07-01T19:07:01","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1559"},"modified":"2026-07-01T19:07:01","modified_gmt":"2026-07-01T19:07:01","slug":"seo-poisoned-software-sites-abuse-screenconnect-to-deploy-asyncrat","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1559","title":{"rendered":"SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 01, 2026<\/span><\/span>Malware \/ SEO Poisoning<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT<\/a>.<\/p>\n

Kaspersky said the activity is part of a \u00abmassive, multi-domain, multi-language\u00bb campaign that distributes malicious installer archives hosted on spoofed websites.<\/p>\n

These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam, among others. The Russian cybersecurity company said it identified more than 90 domain names localized across 10 languages, including English, Russian, Chinese, German, French, Spanish, Portuguese, and Arabic. Some of these domains were set up between August 2025 and March 2026.<\/p>\n

\u00abThe malicious archives bundle a legitimate, signed Microsoft install.exe binary alongside a rogue install.res.1033.dll library,\u00bb security researcher Denis Kulik said<\/a>. \u00abIt is loaded onto the device via DLL side-loading and deploys the ScreenConnect service, which awaits further instructions from the threat actors.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThis allowed the attackers to maintain control over compromised endpoints, with victims ranging from individual users to organizations.\u00bb<\/p>\n

<\/p>\n

Once ScreenConnect is up and running, the service creates and executes a PowerShell script (\u00abFj5NmEsp9EuKrun.ps1\u00bb), which configures Microsoft Defender exclusions, disables User Account Control (UAC) prompts, and then creates a Visual Basic Script (VBScript) file called \u00abinstaller_method3_stream.vbs.\u00bb<\/p>\n

\"\"<\/a><\/div>\n

The script, for its part, creates a set of five files in the \u00abC:\\Users\\Public directory\u00bb –<\/p>\n