Cybercriminals exploit AI hype to spread ransomware, malware

Threat actors linked to lesser-known ransomware and malware projects now use AI tools as lures to infect unsuspecting victims with malicious payloads. This development follows a trend that has been growing since last year, starting with advanced threat actors using deepfake content generators to infect victims with malware. These lures have become widely adopted by info-stealer malware operators and ransomware operations attempting to breach corporate networks. Cisco Talos researchers have discovered that the same technique is now followed by smaller ransomware teams known as CyberLock, Lucky_Gh0$t, and a new malware named Numero. The malicious payloads are promoted via SEO poisoning and malvertising to rank them high in search engine results for specific terms. AI tool impersonation CyberLock is PowerShell-based ransomware delivered through a fake AI tool website (novaleadsai[.]com) posing as the legitimate novaleads.app. Malicious website delivering CyberLock ransomware Sourc ... Read full article.