Fake AI guides hide a multi-stage malware chain that delivers AsyncRAT
By Cara Lin | June 11, 2026
Affected Platforms: Microsoft Windows
Impacted Users: Any organization
Impact: Attackers gain control of the infected systems
Severity Level: High
As AI adoption continues to grow, threat actors have wasted no time exploiting the trend. FortiGuard Labs recently observed a campaign delivering malicious files disguised as AI-related documents, with titles such as "AI-Ready PostgreSQL 18: Building Intelligent Data Systems" and " A Guide for Thinking Marketers in the Age of AI."
These lures are designed to target users actively seeking AI-related learning resources. The attack chain behind these files is remarkably complex, using multiple staged scripts to hide activity before ultimately deploying AutoHotkey-based loaders that reflectively inject a .NET remote access trojan and AsynRAT into memory for command-and-control communication and follow-on execution. Notably, several intermediate-stage scripts make heavy use of Simplified Chinese variable names and exhibit a highly structured coding style, suggesting the threat actor likely leveraged AI assistance during development. This article walks through each stage of the infection chain in detail.
Figure 1: Attack chain
The Initial ZIP with LNK
The malware was distributed inside a compressed archive disguised as a technical resource titled Agentic Coding with Claude Code, The everyday developer’s guide to agentic coding with Claude Code.7z. At first glance, the archive appears harmless. Its visible contents are limited to a shortcut file, but it actually contains two other files named 3th.pdf and 4th.pdf with a Hidden attribute. The archive was intentionally designed to appear harmless. The archive does not distribute a straightforward executable. Instead, it delivers a carefully staged intrusion chain in which each phase exists primarily to reveal the next.
Figure 2: LNK and hidden files in the archived file
Once the victim opens the LNK file, the shortcut executes an obfuscated command sequence built from native Windows components such as cmd.exe, more, type, and findstr. The LNK treats 3th.pdf not as a document, but as a data container. It enumerates the file line by line, extracts a narrow range of lines (26004, 26005, 26006, and 26007), and executes only that extracted content. The attacker doesn’t place their payload in a single obvious script or executable. Instead, they use a single file as a multi-zone storage container, with each phase knowing only how to retrieve the next phase at a specific offset.