SEO Poisoning Campaign Uses Fake Popular Apps to Deliver AsyncRAT

SEO Poisoning Campaign Distributes AsyncRAT

Since October 2025, a persistent SEO poisoning campaign has been targeting users by manipulating search results to distribute trojanized installers for over 25 popular applications, ultimately deploying the AsyncRAT remote access trojan.

The operation involves fake download portals, weaponized installers, and tokenized delivery URLs to bypass URL-based blocking and traditional web filtering.

Analysis revealed a single, multi-stage campaign aimed at users searching for legitimate free software. The responsible threat actor remains unidentified but has shown operational sophistication by regularly updating their infrastructure and delivery methods.

Investigators from FOX-IT and NCC Group identified the activity in March 2026 after noticing a surge in ScreenConnect-related alerts in multiple client environments.

The adversary uses SEO poisoning to rank their lure sites highly, targeting users searching for popular tools such as VLC Media Player, OBS Studio, and others. These sites mimic legitimate software portals, bundling authentic installers with malicious components to lower user suspicion.

The attack begins when a user searches for a known application and clicks on a poisoned search result leading to a domain like vlc-media[.]com instead of the official site.

Clicking the download button retrieves a ZIP archive containing the legitimate installer along with malicious DLLs, including a rogue libvlc.dll. When executed, Windows sideloads the DLL, extracting and running a hidden MSI installer while starting the application to avoid detection.

The MSI installer deploys ScreenConnect, preconfigured for attacker access, disguised in system metadata to blend in with other installed programs. Using ScreenConnect, the attacker deploys tools to inject an AsyncRAT payload, establishing persistent remote access.

The AsyncRAT variant includes a cryptocurrency clipper, a plugin framework for new capabilities, and geo-fencing logic to avoid certain regions. Multiple command-and-control endpoints were linked to the infrastructure.

The campaign leverages extensive SEO optimization, including hreflang tags and fake Schema.org ratings. Sites also carry verification tokens and keywords to attract specific user demographics.

A shared JavaScript component, download-link.js, manages payload delivery through a configuration file, ensuring each payload link is unique and difficult to block.

Transitioning from static paths to token-based delivery complicates URL-level detection, making the campaign more resilient to countermeasures.

Unexpected ScreenConnect installations and new custom URL handlers should be treated as potential early indicators of compromise. Any confirmed infection should trigger a full incident response, including credential resets and host reimaging.

Network monitoring should alert on access to known lure domains and delivery backends, along with identified AsyncRAT command-and-control hosts. Suspicious DLL sideloading and MSI execution warrant immediate investigation.

User education is crucial as the initial lure exploits trust in search results. Users should verify download domains against official vendor URLs and be cautious of unexpected prompts during software installations.

Based on reporting by GBHackers.