AI-Generated Phishing Sites Distribute Remote Access Tool in Cyberattack Campaign
Kaspersky reported detecting a cyberattack campaign that uses AI-generated fake websites to trick users into downloading the Syncro remote access tool. Attackers impersonate legitimate sites like cryptocurrency wallets and antivirus programs, distributing modified versions of Syncro to gain unauthorized access to victims' devices.
What happened
Kaspersky detected a cyberattack campaign in which attackers create fake websites using AI techniques to distribute copies of Syncro, a legitimate remote access tool. The phishing sites impersonate known services such as cryptocurrency wallets or antivirus programs, luring victims through search results or fraudulent emails.
Attackers use the "Lovable" AI tool to generate professional-looking pages with domain names similar to popular keywords like Polymarket. The modified Syncro tool grants attackers full device access including screen viewing, file browsing, and command execution without triggering security alerts, as Syncro itself is not malware.
Reported impact
Attackers send fake security messages to panic users and gain control of their devices to steal funds. Users downloading files from these sites believe they are obtaining safe software for legitimate purposes.
Index analysis
The campaign demonstrates how legitimate remote access tools can be weaponized through social engineering enabled by AI-generated phishing infrastructure. Attackers exploit the visual similarity of AI-generated sites to lower user suspicion at first glance.
Governance controls
Kaspersky recommends verifying website addresses before accessing them and avoiding downloads from untrusted sources, especially on devices used for financial transactions or cryptocurrency activities. The company advises enabling phishing protection features and conducting regular security checks using solutions like Kaspersky Premium, and warns against trusting remote access tools unless their source is known and secure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.