Infostealers disguised as AI tools target 1,258 US companies

A total of 1,258 US companies were targeted by new infostealer malware disguised as generative AI tools, according to a threat analysis report published on the 18th by cybersecurity firm Aviatrix and reported by South Korea’s Maeil Business Newspaper.

The hackers exploited office workers’ everyday habits, building phishing sites that closely imitated official update pages and installation screens for commercial AI tools such as ChatGPT, Claude and Copilot. The fake sites were pushed to the top of search engines through “sponsored” paid keyword advertising.

Once an employee downloaded and ran an installer, a legitimate AI programme appeared to launch — but a PowerShell command ran secretly in the background. Within seconds, the malware scooped up browser login session cookies, cloud administrator authentication tokens and internal financial and payment system access, sending them to the hackers’ external server.

Separately, Kaspersky’s analysis of more than 92,000 “fake AI” attacks detected this year found OpenAI’s ChatGPT accounted for 49 per cent of impersonated brands, while ChatGPT, Anthropic’s Claude and Google’s Gemini made up 85 per cent of all lures.

A cybersecurity industry insider told MK: “Strong management and oversight are needed to completely block software installations except through officially approved in-house AI channels.” The report notes that stealing session tokens defeats even complex passwords and SMS-based two-factor authentication, because attackers copy the “digital pass” proving the user has already passed the login process.

Sources: Maeil Business Newspaper (South Korea), reporting an Aviatrix threat analysis and Kaspersky research — https://www.mk.co.kr/en/world/12178936