Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Cisco Talos has uncovered new threats disguised as legitimate AI tool installers, including CyberLock ransomware, Lucky_Gh0$t ransomware, and a newly-discovered malware called Numero. These threats exploit the increasing popularity of AI across various industries. CyberLock, developed using PowerShell, encrypts specific files and demands a $50,000 ransom in Monero. Lucky_Gh0$t is a variant of Yashma ransomware, distributed as a fake ChatGPT installer. Numero, masquerading as an AI video creation tool, manipulates the Windows GUI, rendering systems unusable. Threat actors are using SEO poisoning and social media to distribute these fraudulent installers, targeting businesses in B2B sales, technology, and marketing sectors. Organizations must exercise caution and rely on reputable vendors to avoid falling prey to these malicious campaigns.

Cisco Talos has identified a new wave of cyber threats that leverage the growing popularity of AI tools by disguising malware as legitimate AI software installers. The primary malicious payloads include CyberLock ransomware, Lucky_Gh0$t ransomware, and a newly discovered malware named Numero. CyberLock ransomware is implemented using PowerShell scripts and targets specific file types for encryption, demanding a ransom payment of $50,000 in Monero cryptocurrency. Lucky_Gh0$t is a variant of the Yashma ransomware family and is distributed under the guise of a fake ChatGPT installer, exploiting user trust in popular AI applications. Numero malware masquerades as an AI video creation tool but instead manipulates the Windows graphical user interface, effectively rendering infected systems unusable and causing operational chaos. These threats are propagated through SEO poisoning techniques and social media campaigns, which direct victims to download these fraudulent installers. The attackers specifically target organizations in B2B sales, technology, and marketing sectors, where AI adoption is rapidly increasing. The lack of known exploits in the wild suggests these campaigns may be in early stages or targeted, but the use of sophisticated social engineering and distribution methods indicates a significant risk. The threat actors exploit user trust in AI tools and the current hype around AI technologies to increase infection rates. The malware variants differ in their impact: ransomware strains encrypt data for financial gain, while Numero disrupts system usability, potentially causing downtime and productivity loss. This multi-faceted approach increases the overall threat landscape complexity for organizations relying on AI tools or interested in adopting them.

MD5 of e34b8c9798b92f6a0e2ca9853adce299b1bf425dedb29f1266254ac3a15c87cd

MD5 of c484d3394b32e3c7544414774c717ebc0ce4d04ca75a00e93f4fb04b9b48ecef

MD5 of 080e29e52a87d0e0e39eca5591d7185ff024367ddaded3e3fd26d3dbdb096a39

MD5 of b53f9c2802a0846fc805c03798b36391c444ab5ea88dc2b36bffc908edc1f589

MD5 of 14c1cb13ffc67b222b42095a2e9ec9476f101e3a57246a1c33912d8fe3297878

MD5 of f52b4d81c73520fd25a2cc9c6e0e364b57396e0bb782187caf7c1e49693bebbf

MD5 of ca11eb7b9341b88da855a536b0741ed3155e80fc1ab60d89600b58a4b80d63a5

MD5 of 79b041cedef44253fdda8a66b54bdd450605f01bbb77ea87da31450a9b4d2b63

MD5 of 0759b628512b4eaabc6c3118012dd29f880e77d2af2feca01127a6fcf2fbbf10

MD5 of 1182b8e97daf59ad5abd1cb4b514436249dd4d36b4f3589b939d053f1de8fe23

MD5 of 527a40f5f73aeb663c7186db6e8236eec6f61fa04923cde560ebcd107911c9ff

MD5 of ebdefa6f88e459555844d3d9c13a4d7908c272128f65a12df4fb82f1aeab139f

MD5 of 57a90105ad2023b76e357cf42ba01c5ca696d80a82f87b54aea58c4e0db8d683

MD5 of e2171735f02f212c90856e9259ff7abc699c3efb55eeb5b61e72e92bea96f99c

MD5 of d1efebcca578357ea7af582d3860fa6c357d203e483e6be3d6f9592265f3b41c

MD5 of a71e274fc3086de4c22e68ed1a58567ab63790cc47cd2e04367e843408b9a065

MD5 of f5efd939372f869750e6f929026b7b5d046c5dad2f6bd703ff1b2089738b4d9c

MD5 of 2850a346ecb7aebee3320ed7160f21a744e38f2d1a76c54f44c892ffc5c4ab77

MD5 of 03b5c76ad07987cfa3236eae5f8a5d42cef228dda22b392c40236872b512684e

MD5 of 51fa1d7b95831a6263bf260df8044f77812c68a9b720dad7379ae96200b065dd

MD5 of 63cde9758f9209f15ee4068b11419fead501731b12777169d89ebb34063467ea

MD5 of a2c17f5c7acb05af81d4554e5080f5ed40b10e3988e96b4d05c4ee3e6237c31a

MD5 of 4787df4eea91d9ceb9e25d9eb7373d79a0df4a5320411d7435f9a6621da2fd6b

MD5 of 0de612ea433676f12731da515cb16df0f98817b45b5ebc9bbf121d0b9e59c412

SHA1 of ebdefa6f88e459555844d3d9c13a4d7908c272128f65a12df4fb82f1aeab139f

SHA1 of 4787df4eea91d9ceb9e25d9eb7373d79a0df4a5320411d7435f9a6621da2fd6b

SHA1 of 0de612ea433676f12731da515cb16df0f98817b45b5ebc9bbf121d0b9e59c412

SHA1 of f52b4d81c73520fd25a2cc9c6e0e364b57396e0bb782187caf7c1e49693bebbf

SHA1 of 2850a346ecb7aebee3320ed7160f21a744e38f2d1a76c54f44c892ffc5c4ab77

SHA1 of d1efebcca578357ea7af582d3860fa6c357d203e483e6be3d6f9592265f3b41c

SHA1 of c484d3394b32e3c7544414774c717ebc0ce4d04ca75a00e93f4fb04b9b48ecef

SHA1 of f5efd939372f869750e6f929026b7b5d046c5dad2f6bd703ff1b2089738b4d9c

SHA1 of 0759b628512b4eaabc6c3118012dd29f880e77d2af2feca01127a6fcf2fbbf10

SHA1 of 03b5c76ad07987cfa3236eae5f8a5d42cef228dda22b392c40236872b512684e

SHA1 of 527a40f5f73aeb663c7186db6e8236eec6f61fa04923cde560ebcd107911c9ff

SHA1 of 57a90105ad2023b76e357cf42ba01c5ca696d80a82f87b54aea58c4e0db8d683

SHA1 of b53f9c2802a0846fc805c03798b36391c444ab5ea88dc2b36bffc908edc1f589

SHA1 of 080e29e52a87d0e0e39eca5591d7185ff024367ddaded3e3fd26d3dbdb096a39

SHA1 of a71e274fc3086de4c22e68ed1a58567ab63790cc47cd2e04367e843408b9a065

SHA1 of e2171735f02f212c90856e9259ff7abc699c3efb55eeb5b61e72e92bea96f99c

SHA1 of a2c17f5c7acb05af81d4554e5080f5ed40b10e3988e96b4d05c4ee3e6237c31a

SHA1 of 51fa1d7b95831a6263bf260df8044f77812c68a9b720dad7379ae96200b065dd

SHA1 of 14c1cb13ffc67b222b42095a2e9ec9476f101e3a57246a1c33912d8fe3297878

SHA1 of 63cde9758f9209f15ee4068b11419fead501731b12777169d89ebb34063467ea

SHA1 of ca11eb7b9341b88da855a536b0741ed3155e80fc1ab60d89600b58a4b80d63a5

SHA1 of 1182b8e97daf59ad5abd1cb4b514436249dd4d36b4f3589b939d053f1de8fe23

SHA1 of e34b8c9798b92f6a0e2ca9853adce299b1bf425dedb29f1266254ac3a15c87cd

SHA1 of 79b041cedef44253fdda8a66b54bdd450605f01bbb77ea87da31450a9b4d2b63

MD5 of 14ed3878b6623c287283a8a80020f68e1cb6bfc37b236f33a95f3a64c4f4611f

MD5 of 1c38e3cda8ac6d79d9da40834367697a209c6b07e6b3ab93b3a4f375b161a901

MD5 of c02d50d0eb3974818091b8dd91a8bbb8cdefd94d4568a4aea8e1dcdd8869f738

MD5 of 4ffc33bdc8527a2e8cb87e49cdc16c3b1480dfc135e507d552f581a67d1850a9

SHA1 of 14ed3878b6623c287283a8a80020f68e1cb6bfc37b236f33a95f3a64c4f4611f

SHA1 of 4ffc33bdc8527a2e8cb87e49cdc16c3b1480dfc135e507d552f581a67d1850a9

SHA1 of c02d50d0eb3974818091b8dd91a8bbb8cdefd94d4568a4aea8e1dcdd8869f738

SHA1 of 1c38e3cda8ac6d79d9da40834367697a209c6b07e6b3ab93b3a4f375b161a901

Detailed information about Cybercriminals camouflaging threats as AI tool installers. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'fake installers'

Filter Threats

Threats Tagged 'fake installers'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility