Hackers Abusing Windows Search Feature to Install Remote Access Trojans

A legitimate Windows search feature is being exploited by malicious actors to download arbitrary payloads from remote servers and compromise targeted systems with remote access trojans such as AsyncRAT and Remcos RAT.
The novel attack technique, per Trellix, takes advantage of the "search-ms:" URI protocol handler, which offers the ability for applications and HTML links to launch custom local

abusing access asyncrat attack compromise download exploited feature hackers install malicious malicious actors novel protocol protocol handler rat remcos remcos rat remote access remote access trojans search servers systems trellix trojans uri windows