SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT. Kaspersky said the activity is part of a "massive, multi-domain, multi-language" campaign that distributes malicious installer archives hosted on spoofed websites. These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam, among others.

The article describes a large-scale SEO poisoning campaign where unknown threat actors create spoofed software download sites (90+ domains across multiple languages) that impersonate popular tools like OBS Studio, DNS Jumper, DS4Windows, and Bandicam.[3][4][5] These sites deliver malicious installers that abuse the legitimate ScreenConnect remote access tool to establish control of Windows systems and deploy AsyncRAT, enabling surveillance, data theft, and command execution.[1][3][4][5] From a CyberSE.AI perspective, this is a non-AI malware operation but highlights how search manipulation and legitimate remote tools can be weaponized at scale, suggesting similar techniques could target AI-enabled software distribution, AI agents, or AI search interfaces; organizations should continuously red-team their AI-assisted discovery and support workflows to detect and mitigate abuse of trusted tools and poisoned content paths.