Microsoft warns AI chatbots redirecting users to cryptojacking malware
Microsoft researchers discovered that cybercriminals are manipulating AI chatbot recommendations through SEO poisoning to direct users to malware-infected fake utility software. Victims' computers are then compromised with cryptojacking malware that hijacks GPU resources for unauthorized cryptocurrency mining using advanced evasion techniques.
What happened
Microsoft researchers observed cybercriminals using SEO poisoning tactics to trick AI chatbots into recommending spoofed utility websites such as HWMonitor, CrystalDiskInfo, and FurMark.
Victims who followed these AI-suggested links downloaded malware disguised as legitimate hardware monitoring or benchmarking tools. The malware used DLL sideloading to install ScreenConnect, a legitimate remote management tool, giving attackers persistent access to compromised systems.
Reported impact
The campaign targets gamers and PC enthusiasts with high-performance NVIDIA and AMD graphics cards. Once installed, the malware uses advanced evasion methods including process hollowing to mine cryptocurrency in the background while appearing as normal system behavior.
Index analysis
The incident demonstrates how AI chatbot recommendation systems can be manipulated through SEO poisoning to distribute malware at scale. Threat actors exploit the tendency of users to trust AI-generated suggestions and impersonate trusted system utilities to increase infection success rates.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.