AsyncRAT distribution via TryCloudflare, Dropbox, and WSH infection chain
Malware Activity
Summary
Hide ▲
Show ▼
A multi-stage phishing chain is distributing AsyncRAT through TryCloudflare tunnels and Dropbox ZIP links, creating a persistent Windows infection path that ends with shellcode injection into explorer.exe. The initial Windows Script Host (WSH) payload downloads additional scripts from a WebDAV server, then stages batch files and a Python environment to extend execution. The activity matters because it uses trusted infrastructure and living-off-the-land tools to hide delivery, maintain persistence, and support remote access.
Related Happenings
AI-generated PowerShell Active Directory reconnaissance script
Malware Activity
H score23
First: 09.07.2026 17:00
Last: 09.07.2026 17:00
Sources 1
About this happening:
An AI-generated PowerShell script was used in a real Windows intrusion, showing how one-off malware can automate Active Directory reconnaissance and evade signature-ba...
AI-generated PowerShell Active Directory reconnaissance script
Malware ActivityAbout this happening: An AI-generated PowerShell script was used in a real Windows intrusion, showing how one-off malware can automate Active Directory reconnaissance and evade signature-ba...
ModeloRAT malicious PowerShell and Dropbox delivery activity
Malware Activity
H score16
First: 14.05.2026 15:12
Last: 14.05.2026 15:12
Sources 1
About this happening:
The ModeloRAT activity now uses a malicious PowerShell command and a Dropbox ZIP payload to gain persistent footholds, enabling system reconnaissance, screenshot...
ModeloRAT malicious PowerShell and Dropbox delivery activity
Malware ActivityAbout this happening: The ModeloRAT activity now uses a malicious PowerShell command and a Dropbox ZIP payload to gain persistent footholds, enabling system reconnaissance, screenshot...
ClickFix attacks with PySoxy scheduled-task persistence
Malware Activity
H score22
First: 12.05.2026 15:00
Last: 12.05.2026 15:00
Sources 1
About this happening:
Cybercriminals are combining ClickFix with PySoxy to preserve access on victim machines, letting activity restart even after removal attempts. The setup uses a Python SO...
ClickFix attacks with PySoxy scheduled-task persistence
Malware ActivityAbout this happening: Cybercriminals are combining ClickFix with PySoxy to preserve access on victim machines, letting activity restart even after removal attempts. The setup uses a Python SO...
StoatWaffle malware distributed through malicious VS Code projects
Malware Activity
H score29
First: 23.03.2026 20:09
Last: 23.03.2026 20:09
Sources 1
About this happening:
The StoatWaffle malware is being delivered through malicious VS Code projects, creating a live risk of credential theft and remote command execution on developer s...
StoatWaffle malware distributed through malicious VS Code projects
Malware ActivityAbout this happening: The StoatWaffle malware is being delivered through malicious VS Code projects, creating a live risk of credential theft and remote command execution on developer s...
SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM multi-stage malware deployment
Malware Activity
H score18
First: 05.03.2026 14:01
Last: 05.03.2026 14:01
Sources 1
About this happening:
A Windows malware set composed of SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM was deployed across two infection chains, expanding the operation’s command,...
SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM multi-stage malware deployment
Malware ActivityAbout this happening: A Windows malware set composed of SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM was deployed across two infection chains, expanding the operation’s command,...
Timeline
-
14.01.2026 16:18 2 articles · 6mo ago
AsyncRAT delivery chain uses TryCloudflare and Dropbox
Technical Analysis UpdateA multi-stage phishing campaign distributes AsyncRAT through Dropbox ZIP links and TryCloudflare tunnels, using an internet shortcut file, a Windows Script Host initial payload, and follow-on scripts hosted on a WebDAV server. The infection chain stages a Python environment, establishes persistence through Windows startup folder scripts, and injects AsyncRAT shellcode into explorer.exe, while abusing Cloudflare free-tier infrastructure and other trusted services to evade detection.
Show sources
- Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware — thehackernews.com — 14.01.2026 16:18
- Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware — thehackernews.com — 14.01.2026 16:18