Stealthy AsyncRAT malware attacks targets US infrastructure for 11 months

A targeted phishing campaign has been active for at least 11 months delivering AsyncRAT via obfuscated loader chains (GIF→SVG→JS/PowerShell); the loader performs anti-sandbox checks, uses a Sunday-based DGA for C2, and has employed ~300 unique samples and decoys to evade analysis. AT&T Alien Labs published IoCs and detection signatures but did not attribute the actor.