SEO-Poisoned Software Sites Abuse Screen Connect to Deploy AsyncRAT

Summary: Kaspersky reported a "massive, multi-domain, multi-language" campaign in which threat actors use the ScreenConnect remote access tool to deploy and execute AsyncRAT, distributing malicious installer archives on spoofed sites that mimic popular software such as OBS Studio, DNS Jumper, DS4Windows, and Bandicam. The company identified more than 90 domain names localized across 10 languages, some set up between August 2025 and March 2026, with the archives bundling a legitimate signed Microsoft install.exe binary alongside a rogue install.res.1033.dll library that loads via DLL side-loading.
What's compelling: The attackers use search engine optimization to push the fraudulent sites to the top of Google and Bing results, so a user searching for a common utility can land on the malicious installer without ever being phished. Once ScreenConnect is running, a scheduled task named "MasterPackager.Updater" re-executes the chain every two minutes, including after a reboot.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Related: University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026
Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026