AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access

Cybersecuritynews •Tushar Subhra Dutta • July 2, 2026

A stealthy campaign is turning trusted remote access software into a weapon against everyday users and businesses. Attackers have hidden the AsyncRAT trojan inside fake software installers, letting it slip past basic security checks. The campaign relies on DLL sideloading and a legitimate remote tool called ScreenConnect, making it hard for victims to notice anything […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers A significant cybersecurity campaign has emerged, exploiting the legitimate remote access tool ScreenConnect to deploy AsyncRAT malware. Attackers utilized spoofed websites and typosquatted domains, masquerading as popular software like OBS Studio and Bandicam, to distribute malicious installers. Over 90 domain names in 10 languages were identified, each containing a legitimate Microsoft-signed executable bundled with a rogue DLL. The attack employs DLL sideloading to install the ScreenConnect service, which then executes PowerShell and VBScript to disable security measures and establish persistence. This campaign has affected both individual users and organizations, allowing attackers to maintain covert control over compromised systems. The operation was discovered by Kaspersky's Managed Detection and Response team, which continues to investigate the extensive command and control infrastructure behind the attacks. 7 sources 71

Extracted Entities

AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)