Loading story…
Kaspersky reported a large malware campaign that used spoofed, SEO-poisoned software download sites to distribute trojanized installers that silently deployed ScreenConnect and then AsyncRAT. The fake sites impersonated widely used tools including OBS Studio, DNS Jumper, DS4Windows, Bandicam, Glary Utilities, and Process Hacker, targeting both individual users and organizations across localized pages in 10 languages. Researchers identified more than 90 domains tied to the operation and linked the activity to multiple hosting and command-and-control clusters.
The infection chain abused DLL sideloading by pairing a legitimate Microsoft-signed install.exe with a malicious install.res.1033.dll, allowing attackers to covertly install ScreenConnect before launching PowerShell and VBS scripts to weaken defenses and establish persistence. The attackers then injected AsyncRAT into RegAsm.exe using process hollowing, with infrastructure analysis connecting the campaign to ScreenConnect C2 domains and an AsyncRAT controller at mora1987[.]work[.]gd. Kaspersky assessed that the operation began in October 2025, expanded through early 2026, and appeared to pause at the end of March 2026.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On July 1, 2026, Kaspersky published research describing how investigation of a single ScreenConnect incident exposed a broader malware campaign using DLL sideloading, ScreenConnect, PowerShell and VBS scripts, and AsyncRAT process hollowing.
Kaspersky assessed that the observed campaign activity paused at the end of March 2026 after months of distributing trojanized archives that installed ScreenConnect and delivered AsyncRAT.
Through March 2026, the operation expanded to more than 90 domains localized in 10 languages, impersonating popular software such as OBS Studio, DNS Jumper, DS4Windows, Bandicam, Glary Utilities, and Process Hacker to target both individuals and organizations.
Kaspersky assessed that the malware campaign began in October 2025, using spoofed software download sites and SEO poisoning to distribute trojanized installers that covertly installed ScreenConnect and later deployed AsyncRAT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple campaigns using spoofed download and streaming sites to trick users into installing remote access tools, unwanted applications, and proxyware. Kaspersky found more than 90 fake software domains in 10 languages distributing trojanized Windows downloads that silently installed **ScreenConnect** via DLL sideloading and then deployed **AsyncRAT** for persistent access; in one case, the attackers altered Windows Defender exclusions, disabled **UAC**, and used process hollowing into `RegAsm.exe`. Separately, Gurucul identified a large network of pirated sports-streaming sites exploiting interest in the FIFA World Cup, using mirror domains, typosquatting, cloud-hosted pages, and rotating infrastructure to push fake **Stremio** installers, VPN-themed lures, phishing pages, scams, and unwanted software. Infoblox tied a fake `7zip[.]com` installer campaign to a broader residential proxy operation tracked as **Lurking Lizard**, linking more than 230 domains involved in fake downloads, fake review sites, proxy storefronts, and **WireVPN**-branded applications that appear to enroll devices into a distributed proxy network. The wider proxyware ecosystem is affecting enterprise and consumer environments alike: Infoblox said 65% of its Threat Defense Cloud customers generated DNS queries in 2026 to domains associated with residential proxy activity, totaling more than 500 billion queries per month, underscoring how free VPNs, streaming apps, browser extensions, and low-cost connected devices are being abused to hijack residential IP space for fraud, scraping, account abuse, and regional restriction bypass.
Jul 7, 2026
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026