The Sting of Fake Kling: Facebook Malvertising Lures Victims to Fake AI Generation Website
Essential information
- Published
- 21/05/2025 15:37
- Modified
- 21/05/2025 22:11
- Tags
- 2025-05-21 crypto theft facebook ads infostealer malvertising purehvnc
- Related entities
- 42 observables, 12 techniques (mitre), 1 malware
Description
A threat actor has orchestrated a sophisticated malvertising campaign impersonating Kling AI, a popular AI-powered image and video synthesis tool. The attackers use counterfeit Facebook pages and paid ads to drive traffic to a convincing fake website. Users are tricked into downloading malicious files disguised as AI-generated media, which are actually executable loaders. These loaders employ advanced evasion techniques, including .NET Native AOT compilation, and deploy infostealers with extensive monitoring capabilities. The campaign has a global reach, particularly targeting users in Asia, and exploits the growing popularity of AI content generation platforms. The malware focuses on stealing credentials, session tokens, and monitoring crypto-related activities across multiple browsers and applications.