The Sting of Fake Kling: Facebook Malvertising Lures Victims to Fake AI Generation Website

A threat actor has orchestrated a sophisticated malvertising campaign impersonating Kling AI, a popular AI-powered image and video synthesis tool. The attackers use counterfeit Facebook pages and paid ads to drive traffic to a convincing fake website. Users are tricked into downloading malicious files disguised as AI-generated media, which are actually executable loaders. These loaders employ advanced evasion techniques, including .NET Native AOT compilation, and deploy infostealers with extensive monitoring capabilities. The campaign has a global reach, particularly targeting users in Asia, and exploits the growing popularity of AI content generation platforms. The malware focuses on stealing credentials, session tokens, and monitoring crypto-related activities across multiple browsers and applications.

• LiteLLM supply chain compromiseCampaign2026-10-22
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• Aoki: Infostealer Targets AI Coding Assistant CredentialsMalware2026-10-15
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25