“TryCloudflare” Abuse: AsyncRAT Exploits Free Tunnels to Build Stealthy WebDAV Network

Trend Micro reports a sophisticated multi-stage campaign delivering the AsyncRAT remote access trojan by abusing Cloudflare free-tier services and TryCloudflare WebDAV hosting: victims receive phishing Dropbox links to ZIP files containing .url shortcuts that trigger downloads, a legitimate signed Python runtime is installed to execute ne.py which injects AsyncRAT into explorer.exe, and persistence is achieved via batch files placed in the Startup folder; the report warns that this living-off-the-land approach and cloud-tunneling abuse can bypass reputation checks and urges multi-layered defenses.