Attackers Abuse Python, Cloudflare to Deliver AsyncRAT

Attackers are abusing Python and Cloudflare to deliver AsyncRAT via a phishing campaign that hides malicious activity behind trusted infrastructure. Discovered by researchers at Trend Micro, the campaign uses Cloudflare’s free-tier services and TryCloudflare tunneling domains to host attacker servers and disguise payload delivery, making detections harder for traditional security tools.

The campaign also exploits Python by pulling legitimate downloads from official sources to create a complete Python environment on victims’ machines, enabling code-injection techniques and persistence with startup folder scripts. According to Trend Micro, the attack injects code into explorer.exe using Python and relies on living-off-the-land techniques to evade detection, including WebDAV mounting and built-in system utilities.

The researchers note that phishing remains a successful vector and that double extensions in attachments or links are a key indicator, with lures related to invoices and orders used to entice victims. The article, published on 13 January 2026 by Elizabeth Montalbano, emphasises adopting multilayered security, monitoring outbound cloud-service connections, and deploying endpoint detection and response with behavioral analysis to block such script-based attacks.