The threat is distributed through malicious GitHub repositories that impersonate popular artificial intelligence desktop applications, specifically targeting users searching for specific model names. These projects utilize legitimate platform infrastructure to appear authentic, with landing pages hosting direct download links to malicious archives. The delivery mechanism relies on search engine optimization poisoning to ensure these fake projects rank highly in external search results, even without artificial engagement metrics. The initial access vector is clearly established as user-initiated downloads from these deceptive repositories, creating a risk where unsuspecting individuals install unauthorized software under the guise of legitimate tools.
The execution chain begins with a dropper component placed adjacent to legitimate, signed executables from major AI providers to facilitate indirect loading via a technique known as DLL sideloading. This approach bypasses standard security protections by leveraging the trust associated with valid digital signatures. Once executed, the dropper deploys a loader component responsible for establishing communication with attacker-controlled infrastructure. The campaign demonstrates strong operational security by avoiding dedicated command-and-control servers, instead relying on public platforms like Telegram, Tor, Catbox, and DNS over HTTPS for data exfiltration and payload retrieval. This layered architecture allows the malware to fetch final payloads dynamically while maintaining a low profile against network-based detection systems.[/subscribe_to_unlock_form]
The threat is distributed through malicious GitHub repositories that impersonate popular artificial intelligence desktop applications, specifically targeting users searching for specific model names. These projects utilize legitimate platform infrastructure to appear authentic, with landing pages hosting direct download links to malicious archives. The delivery mechanism relies on search engine optimization poisoning to ensure these fake projects rank highly in external search results, even without artificial engagement metrics. The initial access vector is clearly established as user-initiated downloads from these deceptive repositories, creating a risk where unsuspecting individuals install unauthorized software under the guise of legitimate tools.
The execution chain begins with a dropper component placed adjacent to legitimate, signed executables from major AI providers to facilitate indirect loading via a technique known as DLL sideloading. This approach bypasses standard security protections by leveraging the trust associated with valid digital signatures. Once executed, the dropper deploys a loader component responsible for establishing communication with attacker-controlled infrastructure. The campaign demonstrates strong operational security by avoiding dedicated command-and-control servers, instead relying on public platforms like Telegram, Tor, Catbox, and DNS over HTTPS for data exfiltration and payload retrieval. This layered architecture allows the malware to fetch final payloads dynamically while maintaining a low profile against network-based detection systems.[emaillocker id="1283"]
Indicators suggest the actor behind this campaign has Russian origins, although the uploader accounts display inconsistent time zones to obscure true operational patterns. The campaign has been actively tracked over a two-month period, indicating sustained development and deployment efforts. The use of multiple distinct email addresses and varied time zones reflects a deliberate strategy to complicate attribution and tracking. Defensively, organizations should monitor for unexpected process injection from signed binaries and scrutinize external search results for AI tool downloads, ensuring that software is only obtained from verified official sources to prevent initial compromise.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.004 | Phishing | Spearphishing Voice |
| Execution | T1204.002 | User Execution | Malicious File |
| Defense Evasion | T1574.002 | Hide Artifacts | Hidden Files and Directories |
| Defense Evasion | T1574.001 | Hide Artifacts | Hidden Files and Directories |
| Defense Evasion | T1027.002 | Obfuscated Files or Information | Software Packing |
| Command and Control | T1071.004 | Application Layer Protocol | File Transfer Protocols |
| Command and Control | T1071.004 | Application Layer Protocol | File Transfer Protocols |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Command and Control | B0030 | C2 Communication |
| Execution | B0023 | Install Additional Program |
| Execution | E1204 | User Execution |
| Communication Micro-objective | C0002 | HTTP Communication |
| Communication Micro-objective | C0011 | DNS Communication |
| Anti-Behavioral Analysis | F0015 | Hijack Execution Flow |
The following reports contain further technical details:
[/emaillocker]