{"id":3436,"date":"2025-02-05T11:24:36","date_gmt":"2025-02-05T11:24:36","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/asyncrat-campaign-utilizes-python-payloads-cloudflare-tunnels-for-stealth-attacks\/"},"modified":"2025-02-05T11:24:38","modified_gmt":"2025-02-05T11:24:38","slug":"asyncrat-campaign-utilizes-python-payloads-cloudflare-tunnels-for-stealth-attacks","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/asyncrat-campaign-utilizes-python-payloads-cloudflare-tunnels-for-stealth-attacks\/","title":{"rendered":"AsyncRAT Campaign Utilizes Python Payloads &#038; Cloudflare Tunnels for Stealth Attacks"},"content":{"rendered":"\n<\/p>\n<h1>Malware Campaigns and Phishing Attacks: A Growing Concern<\/h1>\n<h2>Recent Threats and Vulnerabilities<\/h2>\n<h3>AsyncRAT Malware Campaign<\/h3>\n<p>A recent malware campaign has been observed delivering a remote access trojan (RAT) named AsyncRAT by making use of Python payloads and TryCloudflare tunnels.<\/p>\n<h3>AsyncRAT: A Remote Access Trojan<\/h3>\n<p>AsyncRAT is a remote access trojan (RAT) that exploits the async\/await pattern for efficient, asynchronous communication.<\/p>\n<h3>Exploiting TryCloudflare Tunnels<\/h3>\n<p>The malware campaign utilizes TryCloudflare tunnels to deliver the AsyncRAT payload, making it challenging to detect and block.<\/p>\n<h3>Recent Research by CloudSEK<\/h3>\n<p>Recent research by CloudSEK has also demonstrated that it&#8217;s possible to exploit Zendesk&#8217;s infrastructure to facilitate phishing attacks and investment scams.<\/p>\n<h3>Exploiting Zendesk&#8217;s Infrastructure<\/h3>\n<p>Zendesk allows a user to sign up for a free trial of their SaaS platform, allowing registration of a subdomain, that could be misused to impersonate a target.<\/p>\n<h3>Phishing Attacks and Investment Scams<\/h3>\n<p>Attackers can use these subdomains to deliver phishing emails by adding the targets&#8217; email addresses as &quot;users&quot; to the Zendesk portal.<\/p>\n<h3>Lack of Email Checks<\/h3>\n<p>Zendesk does not conduct email checks to invite users, which means that any random account can be added as a member. Phishing pages can be sent, in the guise of tickets assigned to the email address.<\/p>\n<h2>Conclusion<\/h2>\n<p>Malware campaigns and phishing attacks are becoming increasingly sophisticated, making it essential for individuals and organizations to stay vigilant and take proactive measures to protect themselves.<\/p>\n<h2>Stay Informed<\/h2>\n<p>Follow us on Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i> and LinkedIn to read more exclusive content we post.<\/p>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/asyncrat-campaign-uses-python-payloads.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Malware Campaigns and Phishing Attacks: A Growing Concern Recent Threats and Vulnerabilities AsyncRAT Malware Campaign A recent malware campaign has been observed delivering a remote access trojan (RAT) named AsyncRAT&#8230;<\/p>\n","protected":false},"author":19,"featured_media":3437,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-3436","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/malware.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/3436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=3436"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/3436\/revisions"}],"predecessor-version":[{"id":3438,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/3436\/revisions\/3438"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/3437"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=3436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=3436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=3436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}