Phishing Campaign Distributes AsyncRAT, VenomRAT, and XWorm via Fake Invoice PDF

A phishing campaign has been identified that utilizes a fake invoice PDF to deliver multiple remote access trojans (RATs), primarily AsyncRAT, along with VenomRAT and XWorm. The attack begins with a phishing email containing a Dropbox URL leading to a ZIP archive. Upon extraction, the archive reveals a shortcut that connects to a TryCloudflare tunnel, which hosts a series of obfuscated scripts and files. These scripts execute a BAT file that downloads a ZIP file containing malicious Python packages disguised as legitimate files. The campaign employs advanced obfuscation techniques and process injection methods to evade detection. The attackers leverage legitimate cloud services to enhance delivery success. This campaign is reminiscent of an August attack previously analyzed by X-Labs, indicating a trend in the use of legitimate infrastructure for malicious purposes. Security professionals are advised to monitor and block suspicious TryCloudflare domains and flag anomalous downloads.

Key Points: • Phishing emails deliver RATs using fake invoice PDFs as bait. • Attack utilizes layered obfuscation and legitimate cloud services for stealth. • Defenders should monitor TryCloudflare domains and flag suspicious downloads.