AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery

Forcepoint researchers tracked a phishing-driven AsyncRAT campaign that hides payload delivery behind Dropbox links and TryCloudflare tunnels; a multi-stage chain downloads a malicious Python package whose loader uses Early Bird APC injection to deploy AsyncRAT, VenomRAT, or XWorm. The report provides IoCs (URLs, C2 IPs, and file hashes), describes detection coverage and mitigation recommendations, and warns that abuse of trusted infrastructure will continue to aid evasive malware campaigns.