EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

"Threat actors have been observed using seemingly legitimate artificial intelligence (AI) tools and software to sneakily slip malware for future attacks on organizations worldwide. According to Trend Micro, the campaign is using productivity or AI-enhanced tools to deliver malware targeting various regions, including Europe, the Americas, and the Asia, Middle East, and Africa (AMEA) region."

"The campaign has been codenamed EvilAI by Trend Micro, describing the attackers behind the operation as "highly capable" owing to their ability to blur the line between authentic and deceptive software for malware distribution and their ability to conceal its malicious features in otherwise functional applications. Some of the programs distributed using the method include AppSuite, Epi Browser, JustAskJacky, Manual Finder, OneStart, PDF Editor, Recipe Lister, and Tampered Chef. Some aspects of the campaign were documented in detail by Expel, G DATA, and TRUESEC last month."

""This swift, widespread distribution across multiple regions strongly indicates that EvilAI is not an isolated incident but rather an active and evolving campaign currently circulating in the wild," security researchers Jeffrey Francis Bonaobra, Joshua Aquino, Emmanuel Panopio, Emmanuel Roll, Joshua Lijandro Tsang, Armando Nathaniel Pedragoza, Melvin Singwa, Mohammed Malubay, and Marco Dela Vega said."

Threat actors are embedding malware into productivity and AI-enhanced tools to enable future attacks on organizations across the globe. The campaign targets Europe, the Americas, and AMEA and affects sectors including manufacturing, government, healthcare, technology, and retail, with high infection counts in India, the U.S., France, Italy, Brazil, Germany, the U.K., Norway, Spain, and Canada. Trend Micro has codenamed the operation EvilAI and describes the attackers as highly capable for concealing malicious functionality within otherwise legitimate applications. Distributed programs include AppSuite, Epi Browser, JustAskJacky, Manual Finder, OneStart, PDF Editor, Recipe Lister, and Tampered Chef, and some aspects were documented by Expel, G DATA, and TRUESEC.

Read at The Hacker News