AsyncRAT Deployment via Phishing and Cloudflare Exploitation

Socprime

AsyncRAT Deployment via Phishing and Cloudflare Exploitation

First seen 15 Jan 2026, 03:18 UTC • •31.3

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Threat actors have leveraged phishing emails to initiate a multi-stage intrusion chain that deploys the AsyncRAT remote access trojan. This operation utilizes Cloudflare's free-tier infrastructure and legitimate Python environments, employing Windows-native tools for execution and persistence. Victims are targeted through double-extension ZIP files leading to a WebDAV-hosted payload sequence.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 228d ago How this analysis works

More articles in this cluster (3)

Threat Graph

23 entities, 42 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Malware
Phishing
T1053 - Scheduled Task
T1055 - Process Injection
T1059.001 - PowerShell
T1059.003 - Windows Command Shell
T1059.005 - Windows Script Host
T1059.007 - Windows Script Host

Campaign (1)

AsyncRAT Campaign

Organization (1)

Cloudflare

Malware (1)

AsyncRAT

Affected Platform (4)

Microsoft Edge
TryCloudflare
WebDAV
Windows

Tool (8)

Dropbox
PowerShell
Python
Python.exe
Rundll32
Rundll32.exe
Svchost.exe
Windows Script Host

Relationships

AsyncRAT Campaign uses AsyncRAT
AsyncRAT targets Cloudflare
Malware targets Microsoft Edge
Malware targets TryCloudflare
Malware targets WebDAV
Malware targets Windows
Phishing targets Microsoft Edge
Phishing targets TryCloudflare
Phishing targets WebDAV
Phishing targets Windows
T1053 - Scheduled Task targets Microsoft Edge
T1053 - Scheduled Task targets TryCloudflare
T1053 - Scheduled Task targets WebDAV
T1053 - Scheduled Task targets Windows
T1055 - Process Injection targets Microsoft Edge
T1055 - Process Injection targets TryCloudflare
T1055 - Process Injection targets WebDAV
T1055 - Process Injection targets Windows
T1059.001 - PowerShell targets Microsoft Edge
T1059.001 - PowerShell targets TryCloudflare
T1059.001 - PowerShell targets WebDAV
T1059.001 - PowerShell targets Windows
T1059.003 - Windows Command Shell targets Microsoft Edge
T1059.003 - Windows Command Shell targets TryCloudflare
T1059.003 - Windows Command Shell targets WebDAV
T1059.003 - Windows Command Shell targets Windows
T1059.005 - Windows Script Host targets Microsoft Edge
T1059.005 - Windows Script Host targets TryCloudflare
T1059.005 - Windows Script Host targets WebDAV
T1059.005 - Windows Script Host targets Windows
T1059.007 - Windows Script Host targets Microsoft Edge
T1059.007 - Windows Script Host targets TryCloudflare
T1059.007 - Windows Script Host targets WebDAV
T1059.007 - Windows Script Host targets Windows
AsyncRAT Campaign related to Dropbox
AsyncRAT Campaign related to PowerShell
AsyncRAT Campaign related to Python
AsyncRAT Campaign related to Python.exe
AsyncRAT Campaign related to Rundll32
AsyncRAT Campaign related to Rundll32.exe
AsyncRAT Campaign related to Svchost.exe
AsyncRAT Campaign related to Windows Script Host

Following this threat?

Track AsyncRAT and Cloudflare in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

KGB RAT: New Remote Access Trojan Threatens Windows Users The KGB RAT, a Windows Remote Access Trojan, has emerged as a significant threat, offering attackers extensive control over infected systems. Priced as low as $150 per month, it provides features like webcam access, password theft, and psychological harassment tools. First identified in late 2025, KGB RAT is marketed…

ClickFix Scams Target Education Sector and General Public ClickFix scams are increasingly targeting users in the UK, particularly within the education sector, as reported by Jisc and Jammu Kashmir Police. These scams manipulate users into executing malicious commands through fake CAPTCHA prompts and browser error messages. Jisc has blocked between 300 and 37,000 phishing…