SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
SEO-poisoned sites distribute ScreenConnect and AsyncRAT via spoofed software installers.
Unknown threat actors are conducting a massive, multi-domain campaign distributing AsyncRAT malware through spoofed websites impersonating popular software like OBS Studio and Bandicam. The attack leverages ScreenConnect as a remote access tool, deployed via DLL side-loading of rogue libraries bundled with legitimate Microsoft binaries. Kaspersky identified over 90 localized domains across 10 languages, with victims ranging from individual users to organizations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are exploiting users' trust in popular software brands by creating SEO-optimized spoofed websites that serve malware-laced downloads instead of legitimate applications like OBS Studio and Bandicam. The attack chain is particularly dangerous because it abuses ScreenConnect — a trusted remote access tool — deployed through DLL side-loading alongside legitimate Microsoft binaries, making detection significantly harder. With over 90 localized domains spanning 10 languages, the campaign demonstrates a sophisticated, scalable social engineering operation targeting both individuals and organizations globally. This matters because once AsyncRAT is installed, attackers gain persistent remote access, enabling data theft, lateral movement, and further compromise. Users who lack awareness of download source verification are disproportionately at risk.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — mora1987.work.gd
- malware — AsyncRAT
- malware — ScreenConnect