A malware campaign exploits interest in AI by distributing malicious archives containing LNK shortcuts and hidden PDFs. The infection chain uses multiple obfuscation layers involving PowerShell, batch scripts, and AutoHotkey loaders to deploy two .NET RATs, including AsyncRAT. The campaign uses advanced persistence and evasion techniques such as process hollowing, reflective DLL injection, scheduled tasks, and disabling Windows Defender exclusions. The code shows signs of AI-assisted development with Simplified Chinese variable names and Chinese mythology references as symbolic Windows API aliases. The campaign is attributed to a Chinese threat actor and uses AI-themed lures to increase victim engagement. No CVE or patch information is available, and no known exploits in the wild are reported.

The campaign enables attackers to establish persistent remote access on compromised systems via AsyncRAT and another .NET RAT, potentially allowing data theft, system control, and further malicious activities. The advanced evasion and persistence techniques increase the difficulty of detection and removal, posing a medium risk to affected systems. The use of AI-themed lures may increase the likelihood of successful infection among users interested in AI topics.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Organizations should apply standard endpoint protection measures, including updated antivirus and endpoint detection and response (EDR) solutions capable of detecting AsyncRAT and related techniques. Users should be warned against opening unsolicited compressed archives or files claiming to be AI-related learning resources. Monitoring for indicators of compromise such as the provided hashes and suspicious domains can aid detection. Since Windows Defender exclusions are disabled by the malware, ensuring Windows Defender or equivalent security solutions are active and updated is critical.