Targeted attack on Thailand Pass customers delivers AsyncRAT

Zscaler ThreatLabz describes a targeted phishing campaign that tricks Thailand Pass applicants into downloading an ISO containing an obfuscated VBScript which ultimately deploys AsyncRAT; the report details the multi-stage infection chain (HTML/ISO → VBScript → PowerShell), AV-evasion and persistence techniques, process injection into aspnet_compiler.exe, C2 infrastructure, and provides comprehensive IOCs (URLs, IPs, and file hashes) for detection and mitigation.