SEO Poisoning Campaign Uses Fake Popular Apps to Deliver AsyncRAT

Executive summary: A persistent SEO poisoning campaign (active since at least October 2025) lures users searching for popular applications to fake download portals that bundle legitimate installers with malicious DLLs, enabling DLL sideloading and deployment of AsyncRAT via a preconfigured ScreenConnect foothold; the AsyncRAT build contains a cryptocurrency clipper, a plugin framework, geo-fencing, and multiple C2 endpoints, while the operator uses tokenized delivery URLs and SEO tuning to evade detection. Investigators (FOX-IT and NCC Group) identified lure domains, delivery backends, and C2 hosts and recommend monitoring for suspicious ScreenConnect installs, DLL sideloading, access to known lure/delivery domains, and full incident response for confirmed compromises.