Syncro + Lovable: RAT delivery via AI-generated websites | Kaspersky official blog
Source Kaspersky Security Blog
Description
Attackers are building fake websites with Lovable and using these to distribute a trojanized version of the Syncro remote access tool (RAT).
Impact
European organizations and users, particularly those involved in cryptocurrency trading, DeFi, and digital asset management, face significant risks from this campaign. The trojanized Syncro RAT grants attackers full remote control over infected systems, enabling data theft, credential harvesting, and financial fraud. The use of legitimate remote administration software complicates detection and response, increasing dwell time and potential damage. Organizations with employees who handle crypto wallets or sensitive financial data are at heightened risk of direct financial losses. Additionally, managed service providers (MSPs) and IT support teams using Syncro legitimately could be targeted or impersonated, leading to supply chain risks. The campaign's reliance on phishing and search engine manipulation means that even well-protected organizations could be vulnerable if end users are not adequately trained. The medium severity reflects the combination of social engineering, legitimate tool abuse, and potential for significant financial impact, especially in European countries with high crypto adoption and digital service usage.
Defensive guidance
1. Implement strict policies to prevent downloading and installation of software from untrusted or unofficial sources, especially on devices handling financial or crypto-related applications. 2. Educate users to carefully verify URLs, looking for subtle differences in domain names and website design, and to be wary of unsolicited emails urging urgent action or software downloads. 3. Deploy advanced endpoint detection and response (EDR) solutions capable of heuristic detection of suspicious remote access tools and unusual network activity. 4. Configure antivirus and anti-phishing tools to alert on 'Not-a-virus' detections related to remote access tools and investigate promptly. 5. Use multi-factor authentication (MFA) and hardware wallets for cryptocurrency management to reduce the impact of credential theft. 6. Monitor network traffic for unusual outbound connections from endpoints to detect potential RAT command and control communications. 7. Regularly audit and restrict the use of legitimate remote administration tools within the organization, ensuring only authorized builds and configurations are used. 8. Collaborate with threat intelligence providers to stay updated on emerging phishing campaigns and fake website domains related to this threat. 9. Consider deploying browser security solutions that can detect and block access to known malicious or suspicious domains generated by AI tools. 10. For MSPs and IT support teams, verify the integrity and source of remote access tools and educate clients about this threat vector.
References
Community reviews
Related threats
- Langflow 1.8.4 · Path Traversal to Remote Code ExecutionCriticalVulnerability
- Ghost_CMS 6.19.0 · Remote Code ExecutionCriticalExploit
- FreePBX 17.0.2 · Remote Code Execution (RCE)ExploitedVulnerability
- ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution VulnerabilityCriticalVulnerability
- ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability