Cybercriminals camouflaging threats as AI tool installers
Essential information
- Published
- 05/06/2025 01:03
- Modified
- 05/06/2025 01:23
- Tags
- 2025-05-29 2025-06-05 ai ai tools b2b sales chaos cyberlock fake installers lucky_gh0$t marketing sector numero powershell ransomware seo manipulation seo poisoning technology sector yashma
- Related entities
- 20 observables, 8 techniques (mitre), 3 malware, 2 others
Description
Cybercriminals are exploiting the popularity of AI by distributing malware disguised as AI solution installers. Three threats have been identified: CyberLock ransomware, Lucky_Gh0$t ransomware, and a newly discovered destructive malware called Numero. CyberLock, developed using PowerShell, encrypts specific files and demands a $50,000 ransom in Monero. Lucky_Gh0$t is a variant of Yashma ransomware, masquerading as a ChatGPT installer. Numero, imitating an AI video creation tool, manipulates Windows GUI components, rendering systems unusable. These threats primarily target B2B sales, technology, and marketing sectors. The attackers use SEO manipulation and various distribution channels to deceive victims. Organizations are urged to exercise caution and verify sources when downloading AI tools.