Daily Summary
AsyncRAT activity surged on 2026-08-16 with 58 new samples detected, a 159% increase over the 7-day average of 22. This marks the sharpest single-day spike in three weeks, driven primarily by an influx of native executable files and a smaller but notable cluster of JavaScript-based loaders.
New Samples Detected
The sample distribution shifted materially today. While .exe files account for 46 of the 58 new samples (79%), the 9 .js and 3 .vbs files are more significant than their raw numbers suggest. The script-based samples break a four-day pattern where PowerShell and HTA dominated as secondary payload carriers. Filenames observed in the .js cluster follow a consistent theme of invoice and shipping notifications, suggesting a coordinated campaign rather than opportunistic distribution.
Distribution Methods
The JavaScript and VBS samples align with a phishing campaign leveraging compressed attachments, a delivery method that has been largely absent from AsyncRAT activity over the past week. The .js files are obfuscated with a variable substitution routine that matches a known loader pattern last seen in campaigns targeting logistics firms in Q2 2026. The .vbs samples appear to be fallback variants of the same loader, suggesting the operators are actively testing detection evasion across multiple scripting engines.
C2 Infrastructure
One hundred new C2 servers were registered or activated today, a significant expansion given that the average daily intake over the past week has been roughly 35 to 40. The domains show a heavy reliance on freshly registered .top and .xyz TLDs, with several IP addresses hosted on the same subnet in Eastern Europe. Notably, three C2 domains share SSL certificates with infrastructure previously attributed to a RedLine Stealer campaign, suggesting either shared hosting or a crossover between threat actors.
7-Day Trend
Today’s 159% deviation from the 7-day average is the largest observed since a similar surge on 2026-08-09, when sample counts reached 41. Unlike that spike, which was driven by a single malvertising campaign, today’s volume is spread across multiple file types and C2 clusters, indicating broader operational activity rather than a one-off push.
Security Analysis
The coexistence of .js and .vbs loaders in a single campaign, combined with C2 infrastructure that overlaps with RedLine Stealer, suggests a single operator cycling through commodity RATs based on campaign needs. This is not typical of the fragmented AsyncRAT ecosystem, which is usually dominated by independent, low-skill actors. The use of fresh .top and .xyz TLDs against a backdrop of shipping-themed lures points to a targeted phishing wave aimed at procurement and logistics staff.
Defensive teams should prioritize blocking outbound connections to the new C2 subnet and enforce script execution policies on endpoints that handle email attachments. Specifically, restricting Windows Script Host and disabling JavaScript execution via the local browser policy will neutralize the 12 script-based samples without impacting the .exe variants, which still require user execution to compromise a host.