Cybercriminals Exploit AI Hype to Spread Ransomware and Malware

Cybercriminals Exploit AI Hype for Malicious Purposes

In a concerning development, cybercriminals are capitalizing on the growing interest in artificial intelligence (AI) to distribute ransomware and other malicious software. Cisco Talos researchers have uncovered a trend where threat actors are using fake installers for popular AI tools as a means to infect unsuspecting users with various malware 1

1

Source: Hacker News

Malware Disguised as AI Tools

Three primary threats have been identified:

1. CyberLock Ransomware: Distributed through a fake AI solution website impersonating NovaLeads, a legitimate lead monetization platform. The malware encrypts files and demands a $50,000 ransom in Monero cryptocurrency 2

   2

   .

2. Lucky_Gh0$t Ransomware: A variant of the Yashma ransomware, disguised as a ChatGPT installer. It targets files smaller than 1.2GB for encryption and deletes larger files 3

   3

   .

3. Numero Malware: A previously unknown destructive malware that poses as an InVideo AI installer. It corrupts the Windows GUI, rendering the system unusable 1

   1

   .

Distribution Tactics

The cybercriminals employ various methods to distribute their malicious software:

• SEO Poisoning: Fake websites are promoted to appear at the top of search engine results 1

  1

  .
• Malvertising: Malicious ads on social media platforms lead users to fake websites 2

  2

  .
• Impersonation: Legitimate AI tools and companies are mimicked to gain user trust 3

  3

  .

Target Audience and Impact

Source: BleepingComputer

The primary targets appear to be individuals and organizations in the B2B sales and marketing sectors, where AI tools are gaining popularity. Chetan Raghuprasad, a Cisco Talos researcher, stated, "Individuals, small-scale businesses, startups, and other users in established business sectors should evaluate the sources of the AI tools they download and install on their machines to avoid falling prey to such threats" 1

1

Related Stories

NYU Researchers Develop AI-Powered 'Ransomware 3.0', Sparking Cybersecurity Concerns

Fake AI Tools Spread Noodlophile Malware, Targeting Crypto Wallets and Sensitive Data

Fake AI Image Generator Scam Spreads Malware, Targeting Content Creators and Businesses

BrowserVenom Malware Exploits DeepSeek AI Interest to Target Windows Users

Broader Implications

This trend is part of a larger pattern of cybercriminals exploiting emerging technologies. Google-owned Mandiant has also reported on a malvertising campaign attributed to a Vietnam-based threat group, UNC6032, which has been active since mid-2024 2

2

Recommendations for Users

Source: The Register

To protect against these threats, cybersecurity experts recommend:

1. Downloading AI tools only from official websites of major, reputable projects.
2. Exercising caution when following links from promoted search results or social media posts.
3. Being skeptical of offers that seem too good to be true, such as free premium subscriptions.

As the AI hype continues to grow, users must remain vigilant and prioritize cybersecurity when exploring new AI technologies.