Fake AI Websites and Malware Threats

Nikita Shekhawat
Nikita Shekhawat

Marketing Analyst

 
September 9, 2025 3 min read

Mandiant has reported the emergence of over 30 fraudulent AI websites that impersonate legitimate tools like Luma AI, Canva Dream Lab, and Kling AI. These fake sites are used to spread malware, including infostealers and backdoors. The campaign, attributed to a Vietnamese group tracked as UNC6032, has been active since mid-2024 and has gained traction through thousands of social media ads, mainly on Facebook and LinkedIn, which have collectively reached millions of viewers. These malicious ads promise free access to AI video generation capabilities but redirect users to phishing pages that deliver malware payloads upon interaction. According to Mandiant, the ads have gained significant visibility, with estimates of up to 2.3 million users in the EU alone. Key Payloads and Attack Chain The malware delivered through these fake websites typically includes a multi-stage attack chain. In one observed attack, the STARKVEIL dropper was used to deploy three different Python-based payloads after the initial infection. The dropper disguises itself as an executable file with an .mp4 extension, tricking users into executing it. Upon execution, users are prompted with an error message designed to coax them into running the file a second time, completing the attack chain.

Malware attack chain

Image courtesy of Google Cloud Blog The final payloads include GRIMPULL, XWORM, and FROSTRIFT. GRIMPULL acts as a downloader, connecting to command-and-control servers via Tor to retrieve further malicious payloads. XWORM is a remote access trojan capable of logging keystrokes and exfiltrating sensitive information, while FROSTRIFT targets cryptocurrency wallets and password manager extensions. Exploitation of AI Trends The rapid proliferation of AI video generation tools has created a new avenue for cybercriminals. Cybercriminals are now capitalizing on the hype around platforms like a creative AI visuals tool, using fake sites and downloads to spread advanced malware. This evolution highlights how the growing AI space is being manipulated for malicious gain. As interest in AI tools surges, so does the opportunity for malicious actors to exploit this fascination through social engineering tactics. Mandiant highlights how these campaigns have evolved from older malware distribution methods, now leveraging AI as a lure to attract a more trusting audience.

Malicious Facebook ads

Image courtesy of Google Cloud Blog In addition to the reported campaigns, researchers have linked similar activities involving other AI tools, indicating a broader trend of targeting emerging technologies for malicious purposes. Impact on Organizations and Individuals Victims of these campaigns have reported stolen credentials, cookies, and sensitive financial information, raising significant concerns about the implications for both businesses and individual users. Mandiant's analysis indicates that the threat landscape is evolving, with attackers constantly adapting their tactics to evade detection. For organizations navigating this complex landscape, tools like GrackerAI can assist in monitoring these threats and transforming security news into strategic content opportunities. GrackerAI is designed to empower cybersecurity marketing teams by automating insight generation from industry developments, ensuring timely and relevant messaging. As cybercriminals continue to leverage AI trends, it is vital for businesses to stay informed and proactive. Explore GrackerAI's offerings for cybersecurity content automation and strategic marketing solutions at GrackerAI or contact us for more information.

Latest Cybersecurity Trends & Breaking News

Katz Stealer Targets Chrome, Edge, Brave, and Firefox to Steal Login Credentials AI-Generated TikTok Videos Distributing Infostealer Malware

Nikita Shekhawat
Nikita Shekhawat

Marketing Analyst

 

Data analyst who identifies the high-opportunity keywords and content gaps that fuel GrackerAI's portal strategy. Transforms search data into actionable insights that drive 10x lead generation growth.

Related Articles

Quality at Scale: How AI Solves Programmatic SEO's Biggest Challenge

Discover how AI transforms thin programmatic content into high-quality pages that survive Google's 2025 updates. Includes quality metrics and implementation guide.

By Deepak Gupta October 2, 2025 13 min read
Read full article

How AI Tools and Outlook Email Templates Can Streamline Communication

AI writing tools and Outlook templates save time, reduce errors, and boost focus. Learn how smart content and automation turn email into a productivity tool.

October 2, 2025 7 min read
Read full article
lookalike audience

Expand Your Reach: How to Create a Lookalike Audience

Learn how to create lookalike audiences to expand your reach, target high-value leads, and drive B2B SaaS growth. A cybersecurity growth hacking guide.

By Deepak Gupta October 2, 2025 4 min read
Read full article
Link Building

How to Succeed in Link Building Outreach in 2026

Learn effective link-building outreach strategies in 2026 to get quality backlinks with personalized emails, relevance, and real value.

By Deepak Gupta October 1, 2025 4 min read
Read full article