AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery

Cybersecuritynews •Tushar Subhra Dutta • July 2, 2026

AsyncRAT is back in the headlines, and the attackers behind it have found a clever way to hide in plain sight. Instead of relying on suspicious servers, they use Dropbox links and TryCloudflare tunnels, both trusted services that most security tools rarely block. The result is a campaign that slips past everyday defenses while quietly […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AsyncRAT Malware Campaign Exploits Trusted Services for Stealthy Attacks The AsyncRAT malware has resurfaced, utilizing TryCloudflare tunnels and Dropbox links for delivery, which allows it to bypass traditional security measures. This campaign targets various organizations, enabling attackers to maintain control over infected systems, exfiltrate data, and execute commands without detection. The use of these trusted services complicates defensive efforts, as they are rarely blocked by security tools. The current status of the campaign indicates ongoing exploitation, with security professionals urged to enhance their defenses against this sophisticated threat. Specific details on the scale of the impact and the number of affected systems remain unclear. 2 sources 67

Extracted Entities

AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)