A sophisticated AsyncRAT malware campaign exploiting legitimate services to bypass detection. Threat actors are using Dropbox URLs and TryCloudflare Quick Tunnels to deliver malicious Python packages to unsuspecting victims.
This campaign highlights a growing trend of attackers weaponizing trusted infrastructure to distribute Remote Access Trojans (RATs) and infostealers.
The attack sequence is initiated through phishing emails containing a seemingly harmless Dropbox link disguised as a German invoice download.
When users click the “Rechnung herunterladen” button, they inadvertently trigger a complex, multi-stage infection chain that ultimately deploys AsyncRAT, VenomRAT, or XWorm malware onto their systems.
Dropbox Tunnels Deliver AsyncRAT
The infection begins when the victim downloads a ZIP file from the provided Dropbox URL. Inside this archive is an internet shortcut file pointing to a TryCloudflare subdomain.
Opening this shortcut retrieves a malicious .LNK file, which then uses PowerShell to fetch a heavily obfuscated JavaScript file from another directory on the same temporary tunnel.
This JavaScript file downloads a secondary batch (.BAT) file that orchestrates the core payload delivery using the PowerShell “Invoke-WebRequest” command.
Open a decoy PDF invoice in the victim’s default browser to distract them. Set specific URLs and destination paths for the incoming payload.
Download a large ZIP file containing an embedded Python environment. Extract the contents of the ZIP file into a designated hidden directory. Check if the executable python.exe is accessible on the compromised system.
By staging the attack across various script types moving from shortcut files to JavaScript and finally batch scripts the attackers successfully evade traditional signature-based detection mechanisms.
Including a portable Python setup ensures the malicious code runs correctly even if the victim does not have Python installed natively.
The final stage of the attack centers around an obfuscated Python script named load.py and several associated binary files containing shellcode.
The malicious script uses the ctypes library, a foreign function interface that allows Python to interact directly with the Windows API.
It calls specific functions, such as VirtualAlloc to reserve system memory, RtlMoveMemory to copy data blocks, and CreateThread to execute commands within the virtual address space, Forcepoint said.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| URL (Phishing) | hxxps[:]//dl[.]dropboxusercontent[.]com/scl/fi/7j2004fcny2crqxfl4qfj/R000193294-672PDF[.]zip | Initial Dropbox link distributing the first ZIP file |
| URL (Payload) | hxxps[:]//inventory-card-thumbzilla-ip[.]trycloudflare[.]com/DE/ | TryCloudflare tunnel hosting the malicious .LNK and .JS files |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
