Palo Alto Networks’ Unit 42 reviewed 405 “AI-linked” malware samples and found most never reached real victims, but a small set did spread in the wild. Several successful samples relied on deception, posing as legitimate installers (e.g., a recipe app, Dropbox, and security software components), to trick people into installing malware. Unit 42 concluded AI is mainly speeding up malware development and variation, not making it harder to detect.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re on a recipe site at lunch and see: “Download and install Recipe Lister – free AI recipe finder.” Looks harmless, right? Unit 42 found a real “Recipe Lister” installer just like this. It even had a digital signature, but once installed, it quietly opened a backdoor and spread across more than 50 organizations. Same trick with a fake Dropbox installer: it claimed Dropbox as the publisher, but actually installed the Oyster backdoor. That’s the aha: branding, AI buzzwords, even signatures can all be bait. So if you ever need Recipe Lister, Dropbox, or any AI tool on a work device, do one thing: get it only from our official company portal or the vendor’s official site, never from a random download link.
A large review of “AI-enabled malware” found most samples were proof-of-concepts, but a small set were real threats seen in production environments. The real-world activity included trojanized installers that pretended to be legitimate apps (like a recipe app or a Dropbox installer) and relied on…
Attackers are tricking Minecraft players into downloading malware by impersonating popular Minecraft clients and resellers in Google search results. Even after the campaign’s command-and-control infrastructure was taken down, the operation continued by shifting distribution to common file-hosting…
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
Researchers say the CRPx0 cybercrime operation uses “ClickFix” lures (fake Windows Update and fake Google reCAPTCHA pages) to trick people into running commands that install ransomware. The group also advertises a white-label ransomware service and claims its victim count rose sharply, with data…
