How Fake AI Installers are Outsmarting Human Intelligence with Ransomware

“With the speed at which AI is advancing and the potential that it has, AI has become a ticking time bomb” The rapid growth and high level of excitement around AI is actually have a lot of collateral damage to those companies which are supposed to be using it for good.

Advanced threat actors are now actively utilizing deceitful techniques, levering fake AI software installers as a means to implanting their ransomware and other badware, successfully outsmarting human intelligence and proving a dangerous threat for both – ordinary users and organizations.

Cybersecurity experts are warning of a new series of malware attacks employing bogus websites and fake installers for popular artificial intelligence and machine learning software that has been noticed more frequently on the dark web.

These bad faith actors are exploiting the public’s enthusiasm for exciting new AI technologies like sophisticated language models and video generation. To achieve this, they build authentic-looking fakes of the sites being used to distribute AI software and deceive users into downloading malware in place of the software they were after.

CyberLock cyberlock The ransomware families that goes in these booby traps are a lot of them but what´s the fuss about one of them is CyberLock. Victims are frequently promised free subscriptions or premium access to AI tools.

Once the scam installer is downloaded and run, CyberLock encrypts files across the victim’s infected system, adding the “. cyberlock” extension, and demanding a huge ransom , most often in hard-to-trace cryptocurrencies like Monero. Oddly, some CyberLock ransom notes boast that the stolen funds will be directed at humanitarian efforts.

Another worrying threat is the Lucky_Gh0$t ransomware – a fresh variant of the Yashma ransomware. This ransomware is seen distributed through counterfeit installers pretending to be “ChatGPT 4.0 full version – Premium. exe.” The really nasty part is that these bad packages often frequently contain valid Microsoft open-source AI tools as well as the ransomware payload.

This is probably a way the malware stays unknown to antivirus program. Lucky_Gh0$t encrypts the smaller files, deletes the larger files, and leaves behind a ransom note with a personal ID and instruction to reach out to the attackers using a secure messaging platform.

To top this all off, Numero, a new malware variant, is lurking under the guise of “InVideo AI installer.” Furthermore, unlike traditional ransomware, Numero doesn’t encrypt or steal your data. ” Instead, this one only exists to make the victim’s Windows system entirely nonfunctional.

It does this by using an infinite loop which keeps corrupting the GUI over and over again, replacing window titles, buttons and content with “1234567890” thereby effectively locking the user out of their computer.

These attacks often leverage advanced social engineering tricks, such as SEO poisoning (to show the malicious sites in the search results when searching for topics related to AI) and malvertising (to redirect users from the legitimate to the fake download sites).

Experts warn members of the public to be extremely careful downloading AI software. Software should always be downloaded from the official sites of reputable AI developers First, it is important to download software from the official sites of AI developers; second, care must be taken not to accept unsolicited offers and not to visit sites with slightly changed domain names.

The free or early availability of advanced AI tools and technologies is another reason we should be skeptical and raise the flag of security awareness if we don’t want to be drawn in to the increasingly elaborate ransomware attacks in play.