A Deceptive AI Lure Is Hiding ScreenConnect & XWorm RAT to Hijack Your PC

According to Trustwave SpiderLabs Threat Hunt team, a deceptive AI-themed campaign is abusing the allure of artificial intelligence to lure users into downloading a pre-configured ScreenConnect installer that hides a multi-stage infection chain delivering the XWorm Remote Access Trojan (RAT).

The attackers behind the campaign created convincing fake AI sites, with examples including domains such as gtpgrok[.]ai and anhemvn6[.]com, where malicious ScreenConnect.ClientSetup.msi executables were disguised as video files. Once run, the installer dropped a legitimate ScreenConnect binary but with manipulated Authenticode signatures to modify the application’s behaviour without invalidating its digital signature.

The pre-configured client then connected to attacker-controlled servers to establish a hidden remote access session, with persistence via a registry Run key under HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, masquerading as Windows Security. The final payloads included credential‑theft activity targeting browser data and the use of process hollowing to inject into Chrome and Edge, culminating in a fileless execution flow tied to XWorm.