AsyncRAT Exploits ConnectWise ScreenConnect to Steal Credentials and Crypto

Cybersecurity researchers have detailed a campaign that abuses ConnectWise ScreenConnect, a legitimate remote monitoring and management tool, to deliver a fileless loader that drops AsyncRAT to steal credentials and cryptocurrency data. The infection chain involves a layered VBScript and PowerShell loader that fetches obfuscated components from external URLs, with the payload ultimately unpacking into AsyncRAT and persisting via a fake “Skype Updater” scheduled task, according to LevelBlue.

The loader retrieves two external payloads, logs[.]ldk and logs[.]ldr, which lead to the execution of a binary called AsyncClient.exe, the AsyncRAT payload that can log keystrokes, steal browser credentials, fingerprint the system, and scan for cryptocurrency wallet desktop apps and browser extensions in Chrome, Brave, Edge, Opera and Firefox.

All collected data is exfiltrated to a command-and-control server at 3osch20.duckdns[.]org over a TCP socket, with the C2 settings either hard-coded or pulled from a remote Pastebin URL, as noted by The Hacker News.