Dropbox links as the first hop: the AsyncRAT campaign that hid its malware behind Dropbox URLs and TryCloudflare tunnels
2024 – February 2025
Forcepoint X-Labs and The Hacker News documented a phishing campaign that used Dropbox URLs, not attachments, as the first link in a chain — ZIP to internet shortcut to .lnk to JavaScript to .BAT to a malicious Python package — that ultimately deployed AsyncRAT, Venom RAT, and XWorm via temporary TryCloudflare tunnels.
What happened
Forcepoint X-Labs researcher Jyotika Singh reported in January 2025 that 'this campaign begins with a phishing email containing a Dropbox URL. When the recipient clicks on the link, a ZIP file is downloaded.' From there the infection chain layers one file type on another: 'the URL downloads a ZIP file, which includes an internet shortcut file (.URL format). This file leads to a .lnk file, which then leads to a JavaScript file. This JS file links to a .BAT file.' The .BAT file then 'downloads a ZIP file that retrieves a Python package. The PowerShell 'Invoke-WebRequest' command is utilized to download a large Python package containing malicious .py scripts.'
Forcepoint described the point of the Dropbox hop directly: 'Payloads are downloaded through Dropbox URLs and temporary TryCloudflare tunnel infrastructure, thereby tricking recipients into believing their legitimacy.' The Hacker News, citing Singh, reported that the campaign distributes 'AsyncRAT, Venom RAT, and XWorm.' This was not the technique's debut: Forcepoint had documented a related campaign in August 2024 using the same TryCloudflare-tunnel approach (there the delivery chain started from HTML attachments abusing the 'search-ms' protocol handler rather than Dropbox links), and eSentire had separately reported in July 2024 on the same malware families — XWorm, AsyncRAT, VenomRAT — being delivered over TryCloudflare-proxied infrastructure. Neither of those two earlier reports mentions Dropbox; they are cited here only for the shared TryCloudflare tradecraft, not as evidence the Dropbox stage predates January 2025.
This campaign is distinct from the credential-harvesting wave catalogued elsewhere in this archive ('2024-bec-phishing-pages-hosted-on-dropbox'), where a genuine Dropbox-hosted page was used to steal Microsoft 365 logins. Here Dropbox hosts no phishing page at all — it is simply the first-stage file host for a multi-stage malware dropper, with TryCloudflare tunnels handling the later stages. In both cases the abuse is of Dropbox's hosting by a third party, not a vulnerability in Dropbox itself, and no Dropbox statement addressing this campaign appears in the sources reviewed.
Impact
Using a Dropbox URL as the first hop lets the download sail past reputation and domain-based filtering that would otherwise flag an unfamiliar host, since the initial request genuinely goes to dropbox.com; the malicious infrastructure only appears several stages later, behind a temporary TryCloudflare tunnel that is gone before it can be blocklisted. Once installed, AsyncRAT, Venom RAT, and XWorm give an attacker full remote access to the victim machine. The likely defensive response — treating dropbox.com links in unsolicited email with the same suspicion as any other unknown URL — comes at the cost of flagging Dropbox's own legitimate sharing links.
Sources
- 01
- 02
- 03
- 04