Loading story…
Security researchers reported an AsyncRAT malware campaign that used phishing emails and HTML smuggling to deliver malicious ISO images while bypassing traditional network inspection. The lures arrived as HTML attachments disguised as receipts or order confirmations, with embedded JavaScript reconstructing a Base64-encoded ISO directly in the victim’s browser instead of downloading it from a remote server. Researchers said the activity was active from at least September 2021 and in some cases also used drive-by delivery, with the technique helping the attackers evade sandboxes, proxies, firewalls, and many antimalware engines for months.
When victims opened the mounted ISO on Windows, it exposed a .bat or .vbs file that launched PowerShell, fetched or unpacked additional stages, established persistence, and executed .NET components in memory before deploying AsyncRAT and in some cases NJRAT. The campaign used multiple defense-evasion measures, including antivirus checks, Windows Defender exclusions, UAC bypass, disabling Action Center notifications, reflective DLL loading, and process injection into legitimate binaries such as aspnet_compiler.exe and MSBuild.exe; researchers also linked earlier variants to crypter-as-a-service tools including HCrypt and Alosh and warned of follow-on risks including credential theft and data exfiltration.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Morphisec described an active phishing campaign using HTML attachments named like receipts to generate ISO payloads locally in the browser, avoiding remote ISO downloads and helping evade network inspection. The infection chain mounted the ISO, launched a BAT or VBS file, used PowerShell and an in-memory .NET module, and commonly hid the final AsyncRAT payload inside aspnet_compiler.exe.
Morphisec said a phishing campaign delivering AsyncRAT through HTML attachments disguised as receipts could be traced back to September 12, 2021. The campaign used embedded JavaScript to generate a malicious ISO locally in the victim's browser from a Base64 string.
Menlo Security reported a campaign it named ISOMorph that used HTML smuggling via email attachments and drive-by downloads to locally generate malicious ISO files in the browser and ultimately install AsyncRAT/NJRAT on Windows systems. The report also described persistence, reflective DLL loading, and injection into MSBuild.exe, with payloads hosted on Discord.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourcethehackernews.com
Open sourcemenlosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026
Trellix reported a phishing campaign that abuses the Windows `search-ms` and `search` URI protocol handlers to push victims from emails, HTML attachments, PDFs, or compromised websites into Windows Explorer views populated with attacker-controlled remote files. The activity relies on JavaScript or script-based redirects to remote WebDAV searches, where malicious `.lnk` files are presented as familiar local search results, lowering suspicion and increasing the likelihood of execution. Researchers observed multiple delivery and execution chains involving HTML, PowerShell, ISO, ZIP, DLL, VBS, and EXE files, with payloads ultimately deploying **AsyncRAT** and **Remcos RAT**. The campaign used SSL-encrypted traffic, rapidly rotated infrastructure and files, and disguised artifacts with deceptive filenames and icons; in some cases, execution was triggered through `regsvr32.exe` or PowerShell. Trellix said the technique can provide initial access from a simple URL visit and recommended mitigating the threat by disabling the vulnerable URI handlers through registry removal.
Aug 1, 2026
Researchers across multiple reports documented continued **njRAT** (also known as **Bladabindi**) activity delivered through diverse infection chains, including malicious PowerPoint macros, phishing attachments, password-protected archives, trojanized software on Korean webhard sites, compiled AutoHotKey loaders, and typosquatted npm packages. The malware was shown using layered obfuscation in VBS and PowerShell, Base64-encoded payloads, reflective or in-memory loading, and staged retrieval from services such as `paste.ee`, `archive.org`, `wtools.io`, and dynamic DNS infrastructure. In one supply-chain case, the npm packages `jdb.js` and `db-json.js` installed a .NET payload that copied itself as `dchps.exe` and connected to `46.185.116.2:5552`, while other campaigns used domains including `fidapeste2.duckdns.org`, `xxxcarldon.duckdns.org`, and `0.tcp.eu.ngrck.io` for command and control. Analysis of multiple samples showed njRAT maintaining persistence through **Startup folder** copies, **registry Run keys**, shortcuts, mutexes, firewall-rule changes, and even `netsh` exclusions, while some variants bundled legitimate applications so victims would not notice the infection. Once active, the RAT collected host profiling data and supported a broad set of attacker functions, including **keylogging, credential theft, webcam access, screenshot and screen viewing, file transfer, process and registry manipulation, remote shell access, and full remote control** of Windows systems. Reports also linked njRAT delivery to long-running loader ecosystems that rotated payload families such as Houdini, LimeRAT, RevengeRAT, AsyncRAT, and VjW0rm, underscoring the malware’s persistence as a flexible commodity RAT used across phishing, malware-hosting, and software supply-chain abuse.
Aug 15, 2026