The wide-ranging capabilities of generative artificial intelligence attract not only users from around the world but also cybercriminals. Such artificial intelligence tools are already being used for malicious purposes, such as creating convincing phishing messages, malicious code, or finding vulnerabilities.
Moreover, cybercriminals are trying to trick victims into installing malware disguised as artificial intelligence programs. In this regard, ESET specialists have prepared a list of popular methods of spreading such threats—from deceptive advertising on social networks to counterfeit websites and fake applications.
Phishing websites and dangerous browser extensions
In the second half of 2023, ESET products blocked over 650,000 attempts to access malicious domains containing chapgpt or similar text. Victims are most likely to fall into the trap by clicking on a link in social media or an email. Some of these phishing pages may contain links to install malware disguised as an artificial intelligence application.
Another threat is a malicious browser extension. In particular, they were spread through deceptive advertising on Facebook, which promised to redirect users to the official Sora website from OpenAI or Gemini from Google. In fact, the attackers could have been collecting Facebook user credentials. Since August 2023, ESET telemetry has recorded over 4,000 attempts to install a malicious extension. In other cases, dangerous extensions offer artificial intelligence functionality, but in reality, they spread threats.
Counterfeiting artificial intelligence applications
Fake programs were placed in mobile app stores, and some even posed a threat of stealing login credentials, personal, or financial information.
Fake artificial intelligence programs were placed in mobile app stores. ESET.
Fig. 1. Fake ChatGPT web app sending OpenAI API keys to its own server.
Another criminal scheme by fraudsters is the offer of enhanced artificial intelligence capabilities for a fee. After downloading the app, users may be shown a large amount of advertising, required to make in-app purchases, or subscribe to services that are nonexistent or available in very low quality.
Malicious advertising
Cybercriminals are exploiting the popularity of artificial intelligence tools to trick users into clicking on malicious ads, particularly prevalent on Facebook. Last year, Meta warned that many of these campaigns are aimed at compromising companies’ advertising accounts online.
The activity of cybercriminals is compromising the advertising accounts of companies online. ESET.
Fig. 2. Screensaver that shows the Vidar infostealer installer and mimics Midjourney.
Malicious actors gain control of a legitimate account or page, modify the profile information to make it look like an official ChatGPT page, and then use the accounts to display fake advertisements. Cybercriminals are offering a link to the latest version of artificial intelligence tools, but in reality, they are deploying a threat for information theft.
Elegant lures
The attackers also skillfully manipulate users’ emotions, including fear, trust, and curiosity, to make them click on dangerous links or download malicious software. Thus, cybercriminals convince people to click on indecent facts about celebrities or shocking news about certain events, such as fictional stories about fake COVID-19 vaccines. Sometimes it involves offering certain goods or services for free, with an incredible discount, or with exclusive early access.
In the case of artificial intelligence, cybercriminals disguise malware as various applications – from ChatGPT and the video creation model Sora AI to the image generator Midjourney, DALL-E, and the photo editor Evoto. Many of the versions they advertise are unavailable, which further entices the victim, such as “ChatGPT 5” or “DALL-E 3.”
What could be at risk?
In many cases, the goal of cybercriminals is to steal information. Such malware is designed to collect confidential information, specifically login data for corporate accounts or stored bank card information, cookies (to bypass multi-factor authentication), data from messengers, and much more.
However, cybercriminals are not limited to just data theft. Malefactors can also hide any type of malware in applications and links, including ransomware and remote access Trojans. (RAT). This can lead to complete remote control over the device and the data stored on it. Moreover, they can use your device to attack other users.
Cybercriminals can also use financial and identification data to obtain new bank cards in your name or steal crypto assets, gain access to, and sell banking information. In addition, they can even use corporate credentials to attack your employer, partner organization, or supplier company. Recently, attackers used a threat to steal information in order to gain access to Snowflake accounts, resulting in the compromise of tens of millions of customer data.
Add a Comment