Cryptojacking Malware Exploits AI Chatbots and SEO Poisoning

• •Attackers exploit AI chatbots and SEO poisoning to distribute cryptojacking malware.
• •Malware targets high-performance PCs by impersonating trusted software utilities.
• •Persistent access is established via ScreenConnect, enabling further exploitation.

A new cryptojacking campaign is targeting high-performance PC users through malicious downloads disguised as trusted utilities. Attackers leverage SEO poisoning and AI chatbot manipulation to direct users to fake download sites for software like CrystalDiskInfo and HWMonitor. Once downloaded, the malware establishes persistent access using the legitimate remote management tool ScreenConnect, allowing for potential data theft and further exploitation. Microsoft has confirmed the campaign's existence and noted that it focuses on systems with high GPU capabilities to maximize mining output. The malware employs DLL sideloading and process hollowing techniques to evade detection. This campaign highlights the vulnerabilities in AI chatbot recommendations and the ease with which they can be manipulated. Users are advised to avoid relying on AI for software downloads and to verify sources manually. Microsoft Defender has implemented measures to detect and block associated threats.