Threats Tagged 'autohotkey'

This threat involves a sophisticated malware campaign that leverages the hype around artificial intelligence to distribute malicious files disguised as AI-related learning materials. The infection chain is multi-stage and complex, starting with compressed archives containing LNK shortcuts and hidden PDFs. It uses obfuscation techniques with PowerShell, batch files, and AutoHotkey loaders to establish persistence and deploy two .NET Remote Access Trojans, including AsyncRAT. The campaign employs advanced techniques such as process hollowing, reflective DLL injection, and scheduled task persistence, while disabling Windows Defender exclusions to evade detection. The malware scripts use Simplified Chinese variable names and cultural references to Chinese mythology, suggesting AI-assisted development and a Chinese threat actor origin. No specific affected software versions or patches are identified.