Attackers Abuse Python, Cloudflare to Deliver AsyncRAT

Trend Micro researchers uncovered a phishing campaign that leverages Cloudflare free-tier services and TryCloudflare tunneling domains to host multi-stage scripts which install a Python environment, perform code injection into explorer.exe, and deliver AsyncRAT; attackers use invoice-themed lures, double-extension (.pdfurl) archives, and living-off-the-land persistence techniques, with IoCs and mitigation guidance provided.