SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

Wednesday, July 1, 2026 at 05:53 PM UTC·Source: The Hacker News

Updated: Wednesday, July 1, 2026 at 07:00 PM UTC

Executive Summary

Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT. Kaspersky said the activity is part of a "massive, multi-domain, multi-language" campaign that distributes malicious installer archives hosted on spoofed websites. These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam, among others.

Analysis

Source Attribution

Originally published by The Hacker News on Jul 1, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Lloyds joins Integral global FX liquidity network

Integral, a leading currency technology provider to financial markets, today announced that Lloyds has joined its ecosystem as a liquidity provider, further strengthening its institutional FX network.

Just nowFinextra

MEDIUMVulnerability

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-45659 (CVSS score: 8.8), is a case of remote code execution arising from the deserialization of untrusted data. The issue

CVE-2026-45659

1h agoThe Hacker News

MEDIUMVulnerability

Quantum Breakthroughs Compress Post-Quantum Computing Timeline

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/quantum-breakthroughs-compress-post-quantum-computing-timeline-image_small-2-a-32137.jpg" align=right hspace=4><b>Microsoft, Google and AWS cite major gains in reliability and error correction.</b><br>Rapid advances in quantum hardware, AI-assisted error correction and fault-tolerant architectures from Microsoft, Google and Amazon

7h agoBank Info Security