An active cryptojacking campaign uses AI chatbot interactions to surface malicious download sites. The delivery technique extends social engineering beyond conventional search results and increases visibility of malicious software recommendations. The campaign impersonates legitimate system utilities and media or hardware tools, including CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. Targeting focuses on users with high-performance GPUs to maximize mining value per compromised device. Beyond mining, attackers establish persistent remote access using ScreenConnect deployments, enabling follow-on actions such as data theft, lateral movement, or ransomware. The chain begins with users seeking trusted utilities, with malicious sites promoted through SEO poisoning and later through LLM-based recommendation links. Microsoft detected and blocked related activity.
"“This emerging delivery technique extends social engineering beyond conventional search results and increases the visibility of malicious software recommendations,” Microsoft Defender Experts and the Microsoft Defender Security Research Team said in a report published Tuesday."
"“The activity, per the tech giant, impersonates legitimate system utilities like CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear, likely in an attempt to target users who own high-performance GPUs. The idea is to focus on compromising systems with higher mining value than indiscriminately infecting a large number of machines, it added.”"
"“The goals of the campaign are not merely financially motivated. The threat actors have also been found to establish persistent remote access to compromised hosts through ScreenConnect deployments, which could then be leveraged for follow-on activity, such as data theft, lateral movement, or ransomware.”"
"“It all begins when users search for trusted system utilities and hardware-monitoring software on search engines, which surface malicious sites that have been gamed via techniques like search engine optimization (SEO) poisoning. Subsequent iterations observed in April 2026 indicate that users are being directed to these sites not through search engine results, but rather via interactions with large language model (LLM)-based tools.”"
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]