Fake AI Websites and Malware Threats

Pratham Panchariya
Pratham Panchariya

Software Developer

 
May 28, 2025 3 min read

Mandiant has reported the emergence of over 30 fraudulent AI websites that impersonate legitimate tools like Luma AI, Canva Dream Lab, and Kling AI. These fake sites are used to spread malware, including infostealers and backdoors. The campaign, attributed to a Vietnamese group tracked as UNC6032, has been active since mid-2024 and has gained traction through thousands of social media ads, mainly on Facebook and LinkedIn, which have collectively reached millions of viewers. These malicious ads promise free access to AI video generation capabilities but redirect users to phishing pages that deliver malware payloads upon interaction. According to Mandiant, the ads have gained significant visibility, with estimates of up to 2.3 million users in the EU alone. Key Payloads and Attack Chain The malware delivered through these fake websites typically includes a multi-stage attack chain. In one observed attack, the STARKVEIL dropper was used to deploy three different Python-based payloads after the initial infection. The dropper disguises itself as an executable file with an .mp4 extension, tricking users into executing it. Upon execution, users are prompted with an error message designed to coax them into running the file a second time, completing the attack chain. Malware attack chain Image courtesy of Google Cloud Blog The final payloads include GRIMPULL, XWORM, and FROSTRIFT. GRIMPULL acts as a downloader, connecting to command-and-control servers via Tor to retrieve further malicious payloads. XWORM is a remote access trojan capable of logging keystrokes and exfiltrating sensitive information, while FROSTRIFT targets cryptocurrency wallets and password manager extensions. Exploitation of AI Trends The rapid proliferation of AI video generation tools has created a new avenue for cybercriminals. As interest in AI tools surges, so does the opportunity for malicious actors to exploit this fascination through social engineering tactics. Mandiant highlights how these campaigns have evolved from older malware distribution methods, now leveraging AI as a lure to attract a more trusting audience. Malicious Facebook ads Image courtesy of Google Cloud Blog In addition to the reported campaigns, researchers have linked similar activities involving other AI tools, indicating a broader trend of targeting emerging technologies for malicious purposes. Impact on Organizations and Individuals Victims of these campaigns have reported stolen credentials, cookies, and sensitive financial information, raising significant concerns about the implications for both businesses and individual users. Mandiant's analysis indicates that the threat landscape is evolving, with attackers constantly adapting their tactics to evade detection. For organizations navigating this complex landscape, tools like GrackerAI can assist in monitoring these threats and transforming security news into strategic content opportunities. GrackerAI is designed to empower cybersecurity marketing teams by automating insight generation from industry developments, ensuring timely and relevant messaging. As cybercriminals continue to leverage AI trends, it is vital for businesses to stay informed and proactive. Explore GrackerAI's offerings for cybersecurity content automation and strategic marketing solutions at GrackerAI or contact us for more information.

Latest Cybersecurity Trends & Breaking News

Katz Stealer Targets Chrome, Edge, Brave, and Firefox to Steal Login Credentials AI-Generated TikTok Videos Distributing Infostealer Malware

Pratham Panchariya
Pratham Panchariya

Software Developer

 

Backend engineer powering GrackerAI's real-time content generation that produces 100+ optimized pages daily. Builds the programmatic systems that help cybersecurity companies own entire search categories.

Related Articles

The Question Hub Strategy: How B2B SaaS Companies Capture AI Search Traffic

Learn how B2B SaaS companies use Question Hub strategy to capture ChatGPT, Claude & Perplexity traffic. 5-step process with real case studies & results.

By Deepak Gupta July 23, 2025 3 min read
Read full article

Google Adds Comparison Mode for Real-Time SEO Checks

Use Google’s new Search Console comparison mode for hourly SEO audits. Perfect for SaaS & cybersecurity marketers tracking real-time changes.

By Ankit Agarwal July 18, 2025 3 min read
Read full article

2025 Programmatic SEO Playbook: AI, Real-Time Data, and Market Domination

Master 2025 programmatic SEO with AI-powered content, real-time data integration, and dynamic optimization. Includes implementation guide and competitive advantages.

By Deepak Gupta July 6, 2025 10 min read
Read full article

Quality at Scale: How AI Solves Programmatic SEO's Biggest Challenge

Discover how AI transforms thin programmatic content into high-quality pages that survive Google's 2025 updates. Includes quality metrics and implementation guide.

By Deepak Gupta July 6, 2025 13 min read
Read full article