ScreenConnect Malware Campaign Uses SEO Poisoning and Arabic-Language Pages to Target GCC Users

A large-scale, multi-language malware campaign is actively using search engine optimisation poisoning to push fake software download websites to the top of organic results on Google and Bing, tricking users into downloading what appears to be legitimate freeware but which silently installs a backdoored version of the ScreenConnect remote administration tool and deploys the AsyncRAT remote access trojan. The campaign was first documented by IntCyberDigest and confirmed by Kaspersky Securelist research, which published a full technical breakdown including indicators of compromise.

The campaign initially surfaced in late 2025 and has escalated through 2026, targeting both corporate networks and individual users across multiple geographies. The infrastructure spans more than 90 spoofed domains hosted across servers in the United States and Germany. Critically for GCC and MENA security teams, the malicious landing pages have been localised into Arabic, explicitly placing UAE, Saudi Arabia, and wider MENA region users within the confirmed target population.

How the SEO poisoning works

The campaign's entry point is the search engine itself. When a corporate user searches for a common productivity or developer utility, the malicious spoofed domains have been optimised to rank at or near the top of organic results for those queries. Applications impersonated by the fake download sites include OBS Studio, DS4Windows, Process Hacker, and DNS Jumper, all of which are widely used across enterprise and developer environments.

The fake sites accurately replicate the visual design of the official download portals for each application, making visual identification of the fake site difficult for users who are not specifically alert to URL discrepancies. The landing pages are localised into multiple languages including English, Russian, Chinese, German, Spanish, and Arabic, confirming that the operators have built a broad international targeting infrastructure rather than a geographically restricted campaign.

The infection chain

When a user downloads an installer from one of the fake sites, they receive a compressed archive containing two files: a legitimate, digitally signed Microsoft executable binary and a malicious DLL. The email explicitly instructs the recipient to open the files, which reduces user hesitation by framing the action as a required installation step.

The infection chain relies on DLL sideloading. When the victim runs the signed executable, Windows loads the accompanying malicious DLL as part of the application's standard startup routine. The DLL immediately takes control of the process chain, silently installing a customised version of the ScreenConnect service in the background. To maintain the appearance of a legitimate installation, the requested freeware application is still installed and presented to the user through a standard graphical interface. The victim sees the expected software working normally and has no indication that their system has been compromised.

Once the ScreenConnect service is running, it operates with administrative privileges. The malware then executes a series of obfuscated PowerShell and VBScript files to establish persistence, configure Microsoft Defender exclusions across the entire C: drive, and disable User Account Control prompts. With these controls bypassed, the operators deploy AsyncRAT, a fully functional remote access trojan that provides persistent remote control of the compromised system and enables data harvesting from the infected host.

The use of a digitally signed executable as the delivery vehicle is the specific reason that gateway filtering and file reputation controls alone are insufficient against this campaign. A signed binary from a recognised publisher passes most security controls. The malicious DLL accompanying it is not inspected independently if the gateway trusts the signed container.

Why this matters for GCC enterprises

The Arabic-language localisation of the campaign landing pages is the key indicator for GCC security teams. The campaign operators have deliberately invested in building Arabic-language versions of their fake download sites, which confirms that GCC and MENA users are an intended target audience rather than incidental collateral in a broader global operation.

Corporate environments in the UAE and Saudi Arabia where employees download utilities for productivity, media production, or developer work are directly in scope. The applications impersonated by this campaign, OBS Studio for screen recording, DS4Windows for controller management, Process Hacker for system monitoring, and DNS Jumper for network configuration, are all used across GCC enterprise and developer environments.

The campaign connects directly to the broader pattern of SEO poisoning and supply chain attacks documented on MCW this week. The ValleyRAT campaign used fake installers and DLL sideloading through signed executables against corporate targets. The Chrome ad blocker dormant script injection demonstrated how trusted-looking software extensions carry hidden malicious capability. In each case the attack surface is the same: a user trusting a familiar-looking download source.

Immediate defensive actions

Enterprise security teams should brief employees explicitly on the SEO poisoning technique and instruct them to navigate directly to official vendor websites rather than clicking search engine results for software downloads, regardless of how high those results rank. URL inspection before clicking should be a mandatory step for any software download.

At the network and endpoint layer, teams should block the confirmed IOCs listed below and configure web filtering policies that flag newly registered domains in the same keyword categories as major software utilities. Endpoint detection should be configured to alert on ScreenConnect installations that did not originate from an approved deployment pipeline, unexpected DLL loads from user-space directories, and PowerShell execution that modifies Defender exclusion paths or UAC settings.

Confirmed indicators of compromise

• Domain: mora1987[.]work[.]gd (AsyncRAT command and control server)
  URL: hxxps[:]//fileget.loseyourip[.]com/obs-studio-windows-full/gVOMs5VZ9BtlcaM (malicious OBS Studio installer)
  URL: hxxps[:]//direct-download.giize[.]com/dns-jumper/iopbsr4hymbo7nfa1q7j (malicious DNS Jumper installer)

Note: all indicators listed in defanged format. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.