Fileless Malware Deploys Advanced RAT via Legitimate Tools

Researchers uncovered a fileless campaign that abused a compromised ScreenConnect client to run a VBScript/PowerShell loader which loaded payloads into memory and invoked a .NET assembly (Obfuscator.dll) to deploy AsyncRAT. The malware establishes persistence (scheduled task named “Skype Updater”), disables Windows logging, communicates with C2 domains (e.g., 3osch20.duckdns.org), and exfiltrates system information, credentials, browser artifacts and keystrokes, making detection and remediation difficult.