New AutoIT-Based Malware Campaign Hits Windows: Modular, Multi-Layered, and Elusive
A newly identified malware operation is exploiting the scripting capabilities of AutoIT in a layered attack sequence tailored to compromise Windows environments with stealth and persistence.
The attack is triggered by an innocuously named executable, “1. Project”, which sets off a complex, multi-phase infection chain. This culminates in the deployment of a Remote Access Trojan (RAT) capable of giving attackers full control over the target system.
What makes this campaign especially dangerous is its strategic use of AutoIT, a scripting language typically used for automating Windows tasks. Its deep access to system internals has been weaponized to craft a flexible, modular attack framework that is difficult to analyze and easy to evolve.
Upon initial execution, the malware contacts a remote server at hxxps://xcvbsfq32e42313[.]xyz, simultaneously dropping several components onto the victim’s machine — including a PowerShell script and multiple layers of AutoIT scripts — all designed to establish persistence and avoid detection.
The operation was first flagged by SANS Technology Institute researchers on May 19, 2025, who noted that the attackers’ approach allowed them to tweak or replace components independently — making the threat highly adaptable and resilient against conventional security measures.
One notable feature of this malware is its multi-stage deployment. After the first AutoIT script executes, it drops a PowerShell file at “C:\Users\Public\PublicProfile.ps1” and fetches a secondary script, “Secure.au3”, from a malicious server. This script is then run by an AutoIT interpreter disguised as “SwiftWrite.pif.”
The second layer is heavily obfuscated and includes a bespoke string decoder named “Wales”, which unpacks payloads during runtime. It also conducts reconnaissance on the host system — scanning for signs of antivirus software like “avastui[.]exe” to tailor its behavior accordingly.
The final act involves the launch of “jsc[.]exe”, which is injected with a malicious DLL (“Urshqbgpm.dll”). This DLL attempts to re-establish contact with the command and control infrastructure, effectively completing the infection process.
This campaign not only underscores the rising use of AutoIT as a cyber weapon but also signals a trend toward highly modular, evasive malware — posing a formidable challenge for defenders.
