Fake “AI Tool” Ads Drop MediaArena Persistence

How the attack worked

This campaign relies on paid search ads to promote fake free Windows "AI tools," currently themed as recipe and meal-planning apps. Users searching for free software click a paid result, land on a legitimate-looking site, and download an installer that does not require admin rights. Once run, the installer writes files to AppData, adds a Start Menu shortcut, creates an HKCU Uninstall registry key, and drops a Startup folder shortcut for boot persistence. The loader itself, referred to as math.dll, is injected in memory rather than dropped to disk, which limits what file-based scanning alone can catch.

Why it succeeded

The campaign's success comes down to timing and rotation. Persistence was observed being created around 21 seconds into execution, while Microsoft Defender's quarantine action occurred around 29 seconds later. That gap means the malicious artifacts can already be embedded on the endpoint by the time an alert fires. On top of that, the operators rotate lure brand names and domains quickly, for example GiveMeRecipe, KitchenCanvas, and FoodFormula, all fronting the same underlying toolkit. This rotation means indicators like brand names or domains have a short useful life for detection purposes.

What to watch for

• Paid search ads offering a free "AI tool" tied to an unfamiliar or off-brand app name
• Recently created or rotating domains hosting the download
• An installer prompting for a vague AI-related benefit rather than a specific, verifiable feature
• A Startup folder shortcut tied to the downloaded app's name
• An HKCU Uninstall registry key mimicking a legitimate software install

Any of these persistence artifacts on a host that triggered a MediaArena-related alert should be treated as a sign the device may still be compromised, even if the file itself was quarantined.

How to build resistance

Defenders should treat a quarantine alert as the start of an investigation rather than the end of one. Verifying whether anything executed and whether persistence artifacts exist is a more reliable process than relying on the quarantine result alone. Because brand names and domains rotate quickly, detection strategies should lean on behavior-based signals and known persistence mechanisms, such as Startup folder shortcuts and HKCU Uninstall keys, rather than static indicators. End users across all departments, not just technical staff, should be made aware that free "AI tool" ads served through paid search are a common lure format, so they think twice before downloading unfamiliar software promoted this way. SOC and incident response teams should incorporate these specific artifact checks into their playbooks for any related alert.

What is the MediaArena malvertising campaign?

It is a malvertising campaign that uses paid search ads to promote fake free Windows AI tools, currently themed as recipe and meal-planning apps, to trick users into downloading malicious installers.

Does a Microsoft Defender quarantine mean the threat is neutralized?

Not necessarily. Persistence has been observed being written around 21 seconds into execution, while quarantine occurred around 29 seconds, meaning the malicious artifacts can already be in place before detection.

What persistence artifacts should defenders check for?

Defenders should look for a Startup folder shortcut tied to the app name and an HKCU Uninstall registry key mimicking a legitimate install. If either is present, the host should be treated as still compromised.

Why do brand names and domains matter less than behavior in this campaign?

The campaign rotates lure brands and domains quickly, so any single brand or domain indicator has a short shelf life, making behavior and persistence artifacts more reliable signals to hunt on.