Hackers Abuse ScreenConnect Remote Access Tool to Deploy AsyncRAT Through Fake Installers

Gbhackers •Mayura Kathir • July 2, 2026

A wide-reaching campaign in which attackers abused the legitimate remote administration tool ScreenConnect to deploy AsyncRAT via faux software installers. The infection chain leverages trusted binaries, DLL sideloading, reflective loading and process hollowing to achieve stealthy persistence and remote control an approach that capitalizes on the very trust enterprises place in remote management tools. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers A significant cybersecurity campaign has emerged, exploiting the legitimate remote access tool ScreenConnect to deploy AsyncRAT malware. Attackers utilized spoofed websites and typosquatted domains, masquerading as popular software like OBS Studio and Bandicam, to distribute malicious installers. Over 90 domain names in 10 languages were identified, each containing a legitimate Microsoft-signed executable bundled with a rogue DLL. The attack employs DLL sideloading to install the ScreenConnect service, which then executes PowerShell and VBScript to disable security measures and establish persistence. This campaign has affected both individual users and organizations, allowing attackers to maintain covert control over compromised systems. The operation was discovered by Kaspersky's Managed Detection and Response team, which continues to investigate the extensive command and control infrastructure behind the attacks. 7 sources 71

Extracted Entities

Hackers Abuse ScreenConnect Remote Access Tool to Deploy AsyncRAT Through Fake Installers

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)