MalwarePublished 29 May 2025Updated 28 Jun 2025

Cybercriminals camouflaging threats as AI tool installers

Source AlienVault OTX General

Description

Cisco Talos has uncovered new threats disguised as legitimate AI tool installers, including CyberLock ransomware, Lucky_Gh0$t ransomware, and a newly-discovered malware called Numero. These threats exploit the increasing popularity of AI across various industries. CyberLock, developed using PowerShell, encrypts specific files and demands a $50,000 ransom in Monero. Lucky_Gh0$t is a variant of Yashma ransomware, distributed as a fake ChatGPT installer. Numero, masquerading as an AI video creation tool, manipulates the Windows GUI, rendering systems unusable. Threat actors are using SEO poisoning and social media to distribute these fraudulent installers, targeting businesses in B2B sales, technology, and marketing sectors. Organizations must exercise caution and rely on reputable vendors to avoid falling prey to these malicious campaigns.

Impact

For European organizations, the impact of these threats can be substantial. The ransomware variants (CyberLock and Lucky_Gh0$t) pose a direct financial risk through ransom demands and potential data loss if backups are insufficient or compromised. Encrypted files could include sensitive business data, intellectual property, or customer information, leading to confidentiality breaches and regulatory compliance issues under GDPR. The disruption caused by Numero malware, which manipulates the Windows GUI and renders systems unusable, can lead to significant operational downtime, affecting productivity and service delivery. Sectors such as technology, marketing, and B2B sales are particularly vulnerable due to their reliance on AI tools and digital workflows. Additionally, the use of Monero for ransom payments complicates tracing and attribution, potentially encouraging further attacks. The social engineering aspect, leveraging SEO poisoning and social media, increases the likelihood of successful infections, especially in organizations with less mature cybersecurity awareness or controls. The reputational damage from falling victim to such scams can also be significant, impacting customer trust and business relationships. Overall, the threat undermines trust in AI tools and may slow AI adoption if organizations become wary of installing new software without thorough vetting.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat landscape. First, enforce strict software installation policies that restrict users from installing unauthorized applications, especially those claiming to be AI tools from unverified sources. Use application allowlisting to permit only vetted software. Enhance endpoint protection with behavioral detection capabilities to identify ransomware activity and GUI manipulation attempts. Conduct targeted user awareness training focusing on the risks of downloading software from untrusted websites, recognizing SEO poisoning tactics, and verifying software authenticity through official vendor channels. Implement robust backup and recovery procedures, ensuring backups are isolated and regularly tested to mitigate ransomware impact. Monitor social media and SEO channels for emerging fake AI tool campaigns to proactively warn employees and customers. Employ network segmentation to limit lateral movement if an infection occurs. Additionally, leverage threat intelligence feeds to stay updated on indicators of compromise related to these malware families. Finally, collaborate with cybersecurity communities and law enforcement to share information and receive support in incident response.

Indicators of compromise

Domains 4

lgaircon.xyz
cdn.lgaircon.xyz
cdn.phototagx.com
www.roomako.com

IP addresses 1

CC=US ASN=AS36352 colocrossing

192.210.239.172

Hashes 106

0e270acc64710f72ad7112f418b4355bMD5 of e34b8c9798b92f6a0e2ca9853adce299b1bf425dedb29f1266254ac3a15c87cd
141abe9a53751cdb3d3bbb8ff26bd09cMD5 of c484d3394b32e3c7544414774c717ebc0ce4d04ca75a00e93f4fb04b9b48ecef
1d47bd1ac1279b6716c9aae9f861fc14MD5 of 080e29e52a87d0e0e39eca5591d7185ff024367ddaded3e3fd26d3dbdb096a39
28c47ef5c1c6bd8e28e2a6d74baa1bc4MD5 of b53f9c2802a0846fc805c03798b36391c444ab5ea88dc2b36bffc908edc1f589
2970ebc29d2e212eac3ffd39dcbf4c69MD5 of 14c1cb13ffc67b222b42095a2e9ec9476f101e3a57246a1c33912d8fe3297878
3f6f606d4c2727241028f26bec00298dMD5 of f52b4d81c73520fd25a2cc9c6e0e364b57396e0bb782187caf7c1e49693bebbf
412b3093cb163fd7c2ec304911c07f2fMD5 of ca11eb7b9341b88da855a536b0741ed3155e80fc1ab60d89600b58a4b80d63a5
477425e2a2ca53a04b97c8c8cf7f56f7MD5 of 79b041cedef44253fdda8a66b54bdd450605f01bbb77ea87da31450a9b4d2b63
74afacced1586346a1bc5bc4ee93e7a7MD5 of 0759b628512b4eaabc6c3118012dd29f880e77d2af2feca01127a6fcf2fbbf10
74ceec119642832763ceba2e37f116e8MD5 of 1182b8e97daf59ad5abd1cb4b514436249dd4d36b4f3589b939d053f1de8fe23

Community reviews

Loading reviews…