Phishing Campaign Uses Fake Invoice PDF to Drop AsyncRAT, VenomRAT, and XWorm

Gbhackers •Mayura Kathir • July 2, 2026

A sophisticated phishing campaign that uses a fake invoice PDF to mask the delivery of multiple remote access trojans primarily AsyncRAT, but also VenomRAT and XWorm via layered shortcuts. TryCloudflare quick tunnels, and disguised Python packages. The campaign echoes an August attack previously analysed by X‑Labs and reinforces the group’s 2025 Future Insights prediction that […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Distributes AsyncRAT, VenomRAT, and XWorm via Fake Invoice PDF A phishing campaign has been identified that utilizes a fake invoice PDF to deliver multiple remote access trojans (RATs), primarily AsyncRAT, along with VenomRAT and XWorm. The attack begins with a phishing email containing a Dropbox URL leading to a ZIP archive. Upon extraction, the archive reveals a shortcut that connects to a TryCloudflare tunnel, which hosts a series of obfuscated scripts and files. These scripts execute a BAT file that downloads a ZIP file containing malicious Python packages disguised as legitimate files. The campaign employs advanced obfuscation techniques and process injection methods to evade detection. The attackers leverage legitimate cloud services to enhance delivery success. This campaign is reminiscent of an August attack previously analyzed by X-Labs, indicating a trend in the use of legitimate infrastructure for malicious purposes. Security professionals are advised to monitor and block suspicious TryCloudflare domains and flag anomalous downloads. 2 sources 69

Extracted Entities

Phishing Campaign Uses Fake Invoice PDF to Drop AsyncRAT, VenomRAT, and XWorm

The full story

Extracted Entities

Attack Types (1)

Malware (3)

MITRE ATT&CK (1)

Platforms (1)