A large review of “AI-enabled malware” found most samples were proof-of-concepts, but a small set were real threats seen in production environments. The real-world activity included trojanized installers that pretended to be legitimate apps (like a recipe app or a Dropbox installer) and relied on brand trust and code signing to get users to run them.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You see a shiny new AI app called “Recipe Lister” and a big button: “Install Recipe Lister to quickly find recipes.” Looks harmless, right? Here’s the trick: the installer is trojanized. It’s an NSIS installer that pretends to be Recipe Lister, but when you run it, it quietly extracts and runs a JavaScript backdoor from a temp folder. It was seen across more than 50 organizations. And it’s not just fake recipe apps. One sample masqueraded as a Dropbox installer with a signature that reads “Dropbox, Inc.” The signed file was not Dropbox software at all; it dropped a loader that installed the Oyster, also called CleanBoost, backdoor. That’s the aha: a code signature can lie to you. If any “AI” or brand-name installer pops up from the web, and you weren’t expecting it, especially if it runs scripts from a temp folder, stop and report it to IT. Don’t install it yourself.
Palo Alto Networks’ Unit 42 reviewed 405 “AI-linked” malware samples and found most never reached real victims, but a small set did spread in the wild. Several successful samples relied on deception, posing as legitimate installers (e.g., a recipe app, Dropbox, and security software components), to…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Researchers warn about a new macOS infostealer called “CrashStealer” that pretends to be Apple’s Crash Reporter. It uses a legitimate-looking installer and a fake macOS-style password prompt to trick users into unlocking Keychain, then steals credentials and crypto wallet data.
Two real, ongoing intrusion campaigns targeted organizations in Latin America, including a Mexican transportation organization and Brazil’s financial sector. In the Brazil campaign, attackers reportedly got in via a resume-themed phishing attachment, then attempted to download and run tunneling…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers reported a real campaign by the China-based Silver Fox group against a Japanese industrial manufacturer. The attack starts with an invoice-themed phishing message that leads victims to open a ZIP file, triggering a DLL sideloading chain and installing ValleyRAT for persistent remote…
