Threat Actors Weaponize AI Hype to Deliver AsyncRAT

A sophisticated malware campaign exploits growing interest in artificial intelligence by distributing malicious files disguised as AI-related learning resources and technical guides. The attack employs an exceptionally complex multi-stage infection chain beginning with compressed archives containing LNK shortcuts and hidden PDF files. Through multiple layers of obfuscation involving PowerShell scripts, batch files, and AutoHotkey loaders, the campaign establishes persistent access and deploys two distinct .NET Remote Access Trojans including AsyncRAT. The intermediate scripts extensively use Simplified Chinese variable names and exhibit coding patterns suggesting AI-assisted development, with cultural references to Chinese mythology used as symbolic aliases for Windows API calls. The attack implements advanced techniques including process hollowing, reflective DLL injection, and scheduled task persistence while actively disabling Windows Defender exclusions to facilitate execution.

• AsyncRAT and Remcos Delivered in Multi-Stage Phishing CampaignMalware2026-07-03
• How a single ScreenConnect incident exposed a massive campaignMalware2026-07-01
• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29
• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07