Threat actors are abusing the legitimate ScreenConnect remote access tool in a widespread campaign to deploy AsyncRAT malware. The attack chain begins with malicious installer archives, disguised as popular software and promoted via SEO, which use DLL side-loading to deploy ScreenConnect. ScreenConnect then executes scripts to disable security controls and ultimately deploys AsyncRAT via process hollowing, establishing persistent, covert remote access for data theft and surveillance.
Malware ScreenConnect abused to deploy AsyncRAT in widespread campaign July 1, 2026 Share By SC Staff Threat actors are abusing the ScreenConnect remote access tool to deploy AsyncRAT malware, according to Kaspersky. This activity is part of a large, multi-language campaign that distributes malicious installer archives hosted on spoofed websites, according to a recent report by The Hacker News. These malicious installers are disguised as popular software such as OBS Studio and Bandicam, with over 90 domain names identified across 10 languages. The attack chain begins with a legitimate, signed Microsoft install.exe binary bundled with a rogue install.res.1033.dll library. This library is loaded via DLL side-loading, deploying the ScreenConnect service to await further instructions. Once active, ScreenConnect executes a PowerShell script that configures Microsoft Defender exclusions, disables User Account Control, and creates a VBScript file. This VBScript then generates several files in the public directory and triggers a hidden PowerShell script. This script extracts the AsyncRAT module from a text file using process hollowing and establishes a connection to a remote server, allowing covert control, data theft, and screen recording. Persistence is maintained through a scheduled task that runs every two minutes, ensuring the attack chain restarts after a reboot. Threat actors leverage SEO techniques to push these fraudulent websites to the top of search engine results. Source: The Hacker News SC Staff Related Malware RustDuck botnet rapidly evolves with migration to Rust SC Staff July 1, 2026 RustDuck targets a variety of IoT devices, including routers, cameras, and Android set-top boxes, as well as exposed servers running software like ThinkPHP and Jenkins. Malware Attack exploiting SimpleHelp vulnerability deploys novel loader, infostealer Laura French June 30, 2026 The TaskWeaver loader delivers Djinn Stealer, which targets dev credentials and AI tokens. Malware Microsoft dismantles StegoAd campaign using malicious Edge extensions SC Staff June 29, 2026 The StegoAd campaign employed steganography to hide malicious JavaScript within image and font files, making the extensions appear legitimate and functional. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds