Cybercriminals Use Fake AI Guides and Dev Tools to Spread AsyncRAT Malware

Attackers are distributing booby-trapped AI learning materials that execute a staged, largely fileless chain (LNK files and hidden data offsets in PDF-named files powering PowerShell stages and AutoHotkey scripts) to deploy .NET payloads including AsyncRAT and a modular RAT (clay_Client). The campaign uses scheduled tasks disguised as Realtek services, process hollowing, and legitimate tools to stay stealthy; Fortinet recommends blocking unsanctioned scripting engines, tuning endpoint memory scanning, auditing scheduled tasks, and providing vetted AI resources.