AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites

Microsoft discovered an active cryptojacking campaign that exploits AI chatbot recommendations to deliver cryptocurrency mining malware disguised as legitimate utilities.

• •Users querying AI chatbots for software downloads receive links to attacker-controlled sites hosting malicious ZIP archives containing rogue DLLs and legitimate utilities
• •Malware uses DLL sideloading to install ScreenConnect for persistent remote access, enabling data theft, lateral movement, and ransomware deployment
• •Attack establishes persistence through Registry Run keys and scheduled tasks while disabling Windows Defender and using process hollowing to hide mining code
• •Campaign specifically targets high-performance GPU systems to maximize mining profitability, impersonating tools like CrystalDiskInfo, HWMonitor, FurMark, and PDFgear