BrowserVenom Malware Exploits DeepSeek AI Interest to Target Windows Users

New Malware Exploits AI Enthusiasm

A new malware campaign dubbed 'BrowserVenom' is targeting Windows users interested in running DeepSeek's AI models locally. Cybersecurity researchers at Kaspersky have uncovered this sophisticated attack that exploits the growing enthusiasm for AI technologies 1

1

Source: PC Magazine

Attack Vector and Distribution

The attackers are using Google Ads to promote fake websites that mimic the official DeepSeek platform. When users search for "deep seek r1" or related terms, these malicious ads appear at the top of search results, leading unsuspecting victims to a fraudulent domain: http[:]//deepseek-platform[.]com 2

2

Infection Process

Upon visiting the fake website, users are prompted to download what appears to be the DeepSeek R1 model installer. The malicious file, named "AI_Launcher_1.21.exe," presents a convincing installation screen. However, it secretly installs the BrowserVenom malware, which reconfigures the victim's web browsers to route all traffic through a proxy server controlled by the attackers 1

1

Malware Capabilities

BrowserVenom is designed to:

1. Bypass Windows Defender using a special algorithm
2. Install an attacker-created hardcoded certificate for persistent access
3. Add a hardcoded proxy server address to all installed browsers
4. Monitor and potentially decrypt users' browsing activity
5. Sniff sensitive data, including credentials, session cookies, and financial information 3

   3

Geographic Spread and Impact

Kaspersky has detected multiple infections across various countries, including Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt. While the exact number of affected users remains undisclosed, the threat is considered global 2

2

Related Stories

Cybercriminals Exploit AI Hype to Spread Ransomware and Malware

Fake AI Tools Spread Noodlophile Malware, Targeting Crypto Wallets and Sensitive Data

AI Chatbots Recommend Malicious Sites in New Cryptojacking Campaign Targeting High-End GPUs

Fake AI Image Generator Scam Spreads Malware, Targeting Content Creators and Businesses

Attacker Profile

Analysis of the phishing websites' source code revealed comments in Russian, suggesting that Russian-speaking threat actors may be behind this campaign. However, no specific cybercrime group has been attributed to the attack 1

1

Mitigation and Prevention

To protect against such attacks, users are advised to:

1. Verify the authenticity of websites before downloading AI tools
2. Be cautious of search engine ads, especially for AI-related products
3. Use reputable antivirus software and keep it updated
4. Be aware that running open-source AI programs locally often requires multiple steps, not just a single executable 3

   3

Source: TechRadar

Industry Response

Google has reportedly suspended the advertiser's account responsible for promoting the malicious ads. However, the incident highlights the ongoing challenge of securing online advertising platforms against sophisticated cyber threats 2

2