Threat Actors Weaponize AI Hype to Deliver AsyncRAT

#### Executive summary: FortiGuard Labs observed a sophisticated multi-stage malware campaign that uses malicious .lnk files inside archives masquerading as AI-related documents to trigger staged extraction (line-range containers), obfuscated PowerShell decryption, AutoHotkey loaders, and reflective/.NET in-memory RAT deployment (custom RAT and AsyncRAT). The chain establishes robust persistence (scheduled tasks, VBS chains), performs defense evasion (Defender exclusions, string/cmdlet obfuscation, process hollowing, assembly reflection), and includes actionable IoCs (IP 107.172.10.190, three domains, and multiple file hashes) and Fortinet detection names.