SEO Poisoning Campaigns Target Software Downloads
Cybercriminals are increasingly using SEO poisoning tactics to distribute malware like AsyncRAT through trusted remote access tools such as ScreenConnect. This method exploits search engine optimization to lure unsuspecting users to malicious websites, resulting in widespread infections across multiple regions and languages.
How the Attack Works
The campaign, recently analyzed by cybersecurity experts at Kaspersky, involves threat actors creating a network of fake websites that mimic official software download pages. These sites are engineered to rank highly in search results for popular software, including OBS Studio, DNS Jumper, DS4Windows, and Bandicam. When users search for these programs, they are more likely to encounter the malicious sites due to the attackers’ sophisticated SEO poisoning efforts.
Upon visiting these fraudulent websites, victims are prompted to download installer archives. These archives are cleverly designed, bundling a legitimate, signed Microsoft install.exe binary with a malicious install.res.1033.dll library. By leveraging a technique known as DLL side-loading, the attackers execute the rogue DLL, which then silently deploys the ScreenConnect remote access service on the victim’s system. This grants the attackers persistent access to compromised devices, ranging from individual computers to entire organizational networks.
ScreenConnect as a Malware Delivery Vector
Once the ScreenConnect service is running, it executes a PowerShell script named Fj5NmEsp9EuKrun.ps1. This script modifies Microsoft Defender settings to exclude certain files, disables User Account Control (UAC) prompts, and creates a Visual Basic Script file called installer_method3_stream.vbs. The VBScript sets up several files in the C:\Users\Public directory, including:
- msgbox.txt
- secret_bytes.txt
- 1.vb
- cap.ps1
- script.vbs
Next, script.vbs is triggered, terminating all active PowerShell processes and running cap.ps1 in a hidden window. The primary objective is to extract the AsyncRAT payload from secret_bytes.txt and launch it using process hollowing, a technique that allows the malware to inject itself into legitimate processes and evade detection.
AsyncRAT’s Impact and Persistence
With AsyncRAT deployed, the malware establishes a connection to a remote command and control server, enabling the attacker to stealthily monitor infected Windows systems, steal sensitive data, and capture screen content. Persistence is maintained through a scheduled task named “MasterPackager.Updater,” which runs every two minutes and ensures that the attack sequence is re-executed after each system reboot.
The Role of SEO Poisoning in Malware Distribution
Kaspersky’s researchers highlight that the real danger lies in the attackers’ use of SEO poisoning. By carefully optimizing their fake software sites for search engines like Google and Bing, they ensure these sites appear at the top of search results. This increases the likelihood of unsuspecting users downloading the malicious installers, believing them to be legitimate software updates or utilities.
The campaign is “massive, multi-domain, and multi-language,” with over 90 fake domains discovered across ten languages, including English, Russian, Chinese, German, French, Spanish, Portuguese, and Arabic. Some of these domains were created as recently as March 2026, demonstrating the attackers’ ongoing efforts to expand their reach.
Mitigating the Threat of SEO Poisoning and AsyncRAT
To protect against SEO poisoning and threats like AsyncRAT delivered via ScreenConnect, users and organizations should:
- Download software only from official vendor sites or trusted sources.
- Be wary of search results that do not match the official domain or branding of the software publisher.
- Keep security solutions up to date and enable features that detect suspicious downloads and side-loading attempts.
- Regularly audit scheduled tasks and running services for unauthorized entries.
- Educate staff about the risks of downloading software from unverified sources.
Conclusion
The rise of SEO poisoning campaigns distributing malware like AsyncRAT via tools such as ScreenConnect underscores the evolving tactics of cybercriminals. By exploiting search engine optimization, attackers can effectively reach a global audience and compromise countless systems. Vigilance and adherence to best security practices remain the best defense against these sophisticated threats.
This article is inspired by content from Original Source. It has been rephrased for originality. Images are credited to the original source.