{"id":144,"date":"2026-03-16T14:38:39","date_gmt":"2026-03-16T18:38:39","guid":{"rendered":"http:\/\/localhost\/?p=144"},"modified":"2026-03-16T14:38:39","modified_gmt":"2026-03-16T18:38:39","slug":"malware-deployed-using-fake-ai-tool-installers","status":"publish","type":"post","link":"https:\/\/securityblog.denison.edu\/index.php\/2026\/03\/16\/malware-deployed-using-fake-ai-tool-installers\/","title":{"rendered":"Malware deployed using fake software installers"},"content":{"rendered":"\n

While today’s world is increasingly connected, it is also a common mechanism for threat actors to deliver malicious payloads via social engineering. Maliciously crafted advertisements can be used by threat actors to deliver their malware to unsuspecting victims. In a recent set of cyberattacks affecting multiple sectors, threat actors deployed their malware as a part of a fake AI tool installer, intending to install spyware and viruses on victim computers.<\/p>\n\n\n\n

A common attack that targets a corporate environment might play out like this:<\/p>\n\n\n\n

    \n
  1. The threat actor or threat actor group purchases advertising space pertinent to AI tools. The advertisements generally show as a part of web searches. They link the advertisement to their own, malicious website, which purports to have an AI tool available for download.<\/li>\n\n\n\n
  2. The victim downloads the fake AI tool and attempts to install it on their computer.<\/li>\n\n\n\n
  3. The installer “fails” to complete the installation, but suggests that the victim paste a command into the Terminal (on macOS) or the PowerShell (on Windows), also stating that the victim may have to enter their password.<\/li>\n\n\n\n
  4. The command that the victim copies\/pastes into the Terminal or PowerShell is maliciously crafted to sideload a piece of malware, spyware, or virus and alter important system settings. The command the victim runs also gives the threat actor access to the victim’s computer at a low level.<\/li>\n<\/ol>\n\n\n\n

    In another attack mechanism, attackers disguised their malware as cheat software for popular video games, like Fortnite or Counter-Strike. These attacks are more effective especially on younger players, who typically don’t have money for paid subscriptions, often ignore warnings, and are often ashamed to report a hack. Victims are often convinced to disable their antivirus, since cheats often behave like viruses. Once the malware is installed, the threat actor has access to the victim’s computer at a low level.<\/p>\n\n\n\n

    Using their access to the victim’s computer, the threat actor can make the victim’s computer a part of a botnet, infect other computers on the network, steal the victim’s information, or otherwise carry out cyberattacks on both the victim and any computers also on the victim’s network.<\/p>\n\n\n\n

    There are some simple steps you can use to protect yourself from attacks like these:<\/p>\n\n\n\n