A long-running SEO poisoning campaign has been targeting Windows users by impersonating popular software downloads and distributing AsyncRAT malware. Active since October 2025, the operation quietly pushed trojanized installers for more than 25 well-known applications. 
The campaign remained undetected for months before researchers uncovered its multi-stage infection chain in March 2026.
How the Campaign Works
Attackers manipulate search engine rankings to place fake download sites above legitimate results. Victims searching for software unknowingly download malicious packages.
Targeted Applications
The campaign impersonates tools such as:
- VLC Media Player
- OBS Studio
- KMS Tools
- CrosshairX
Each download archive contains:
- Legitimate installer
- Malicious DLL component
- Hidden payload
Because the real application launches normally, users rarely suspect compromise.
Research Discovery
Investigators from NCC Group and Fox-IT uncovered the campaign after detecting unusual remote tool activity across multiple environments.
Their analysis revealed:
- Three relay hosts
- Two payload delivery servers
- Over 100 malicious files
- Multi-language SEO lure pages
Final Payload: AsyncRAT
The campaign delivers a customized build of AsyncRAT with expanded capabilities.
Malware Features
- Keylogging
- Clipboard monitoring
- Cryptocurrency clipper (16 currencies)
- Plugin-based modular extensions
- Remote command execution
- Data exfiltration
The build includes geo-fencing that disables crypto theft in specific regions.
Multi-Stage Infection Chain
Step-by-Step Execution
- User downloads ZIP archive
- Runs legitimate installer
- Malicious DLL sideloaded
- Hidden MSI executed silently
- Remote access tool installed
- PowerShell loader deployed
- AsyncRAT injected in memory
This layered approach helps evade detection.
DLL Sideloading Technique
The infection relies on DLL sideloading using a malicious libvlc.dll. When the legitimate application starts, Windows loads the attacker-controlled DLL.
This allows:
- Execution under trusted process
- Security tool evasion
- Silent payload delivery
Remote Access Deployment
The MSI installer deploys ScreenConnect disguised as a system service.
The service connects to attacker-controlled infrastructure and enables:
- Remote command execution
- File deployment
- Persistence setup
Fileless Payload Execution
The malware avoids disk detection by:
- Writing encrypted payloads
- Decrypting in memory
- Compiling injector dynamically
- Using process hollowing
AsyncRAT is injected into RegAsm.exe, a trusted Windows binary.
Persistence Mechanisms
The campaign establishes multiple persistence methods.
Persistence Techniques
- Auto-start Windows service
- LSASS authentication package
- Scheduled task every two minutes
These mechanisms ensure survival across reboots.
Infrastructure Evolution
Attackers updated delivery infrastructure over time.
Changes Observed
- Static URLs replaced
- Token-based download links
- File-sharing disguise backend
- Randomized payload distribution
These improvements made blocking more difficult.
Risk Impact Analysis
| Risk Area | Impact |
|---|---|
| Endpoint Security | RAT installation |
| Credentials | Keylogging |
| Crypto Assets | Clipboard hijacking |
| Persistence | Multi-layer survival |
| Detection | Fileless execution |
Indicators of Compromise
Security teams should watch for:
- Unauthorized ScreenConnect services
- DLL sideloading behavior
- RegAsm.exe process injection
- Suspicious scheduled tasks
- Unknown authentication packages
Mitigation Recommendations
User Protection
- Download software only from official sites
- Verify domain authenticity
- Avoid search-result downloads
- Check digital signatures
Enterprise Controls
- Monitor DLL sideloading
- Block unauthorized remote tools
- Detect process hollowing
- Inspect scheduled tasks
- Monitor LSASS modifications
Key Takeaways
- SEO poisoning used for malware delivery
- 25+ apps impersonated
- DLL sideloading execution
- AsyncRAT deployed filelessly
- Multiple persistence mechanisms
Conclusion
This campaign demonstrates how attackers weaponize search engine optimization to distribute malware at scale. By combining trusted software impersonation, DLL sideloading, and fileless execution, the operation evades traditional defenses and maintains long-term access.
Organizations should strengthen:
- Software download policies
- Endpoint monitoring
- Remote tool detection
- Behavioral analytics
Search-based downloads remain a major attack vector for supply chain-style malware campaigns.
