SEO Poisoning Campaign Targets Users with AsyncRAT via Fake App Downloads

Since October 2025, a sophisticated SEO poisoning campaign has been targeting Windows users by impersonating over 25 popular software applications. The attackers have been using trojanized installers to deliver the AsyncRAT remote access trojan, compromising victims' systems. This operation remained undetected for approximately five months until it was uncovered in March 2026. The campaign employs a variety of fake download portals to lure users into downloading malicious software. The scope of the impact is significant, affecting a wide range of users who unknowingly downloaded these trojanized applications. Investigators are currently assessing the full extent of the compromise. As of March 2026, the campaign is still active, posing a continuing threat to unsuspecting users. Security professionals are urged to be vigilant and educate users about the risks of downloading software from unverified sources.

Key Points: • The campaign has been active since October 2025, targeting Windows users. • Over 25 popular applications are being impersonated to deliver AsyncRAT. • The operation remained undetected for five months before being uncovered in March 2026.