Zscaler ThreatLabz researchers discovered AI-themed websites exploiting Black Hat SEO to spread malware such as Vidar Stealer, Lumma Stealer, and Legion Loader through complex redirection chains and browser fingerprinting. These campaigns use deceptive JavaScript hosted on trusted CDNs and package malware in large installers to evade detection, targeting users searching for popular AI tools. #VidarStealer #LummaStealer #LegionLoader #BlackHatSEO #getrunkhomuto_info
Keypoints
- Threat actors leverage Black Hat SEO to poison search engine results for AI-related keywords, increasing victim exposure to malicious sites.
- Malicious AI-themed websites use JavaScript to perform browser fingerprinting and multiple redirections to deliver malware payloads like Vidar, Lumma, and Legion Loader.
- The JavaScript detects ad blockers to ensure successful redirection and encrypts collected browser data using XOR encryption to evade detection.
- Vidar and Lumma Stealer malware are delivered via large NSIS installers containing obfuscated AutoIT loaders and Word macro-like files to bypass sandboxes.
- Legion Loader is delivered through password-protected ZIP archives and installs via MSI files that perform custom actions including DLL sideloading and process hollowing.
- Legion Loader’s DataUploader DLL collects system information and communicates with C2 servers, dynamically retrieving encrypted archive passwords.
- Zscaler’s cloud security platform detects various indicators related to these malware campaigns and provides multi-layered protection.
MITRE Techniques
- [T1189] Drive-by Compromise – Malicious JavaScript embedded in fake AI blog sites executes code on the victim’s system (‘Malicious JavaScript embedded in fake AI blogs that executes code on the target’s system’).
- [T1059.003] Command and Scripting Interpreter: Windows Command Shell – The NSIS installer runs batch scripts that remove malware if antivirus software is detected (‘The NSIS installer contains a batch script that deletes the malware if security products are detected’).
- [T1059.001] Command and Scripting Interpreter: PowerShell – PowerShell scripts are used during malware execution flows.
- [T1217] Browser Information Discovery – JavaScript collects browser version, resolution, user agent, and other fingerprinting data.
- [T1083] File and Directory Discovery – Malware performs discovery of files and directories on the infected host.
- [T1057] Process Discovery – Batch scripts identify running processes to prepare for execution of AutoIT payloads (‘Batch script to discover the process and start AutoIT’).
- [T1059.010] Command and Scripting Interpreter: AutoHotkey & AutoIT – AutoIT executes obfuscated scripts as part of the payload delivery.
- [T1574.002] Hijack Execution Flow: DLL Side-Loading – The MSI installation sideloads malicious DLLs by running legitimate executables to load malicious code.
- [T1055] Process Injection – Malicious DLL injects code into explorer.exe using process hollowing to evade detection.
- [T1176] Browser Extensions – Malicious browser extensions are deployed for persistence, including cryptocurrency stealer extensions.
- [T1041] Exfiltration Over C2 Channel – Collected victim information is exfiltrated to command-and-control servers.
Indicators of Compromise
- [Malicious Domains] AI-themed sites hosting malware delivery – chat-gpt-5[.]ai, luma-ai[.]com, krea-ai[.]com, llama-2[.]com
- [File Hashes] Legion Loader malware components – C957ADB29755E586EE022244369C375D (password-protected ZIP), 14642E8FFD81298F649E28DC046D84BB (MSI file), FFDAACB43C074A8CB9A608C612D7540B (DataUploader.dll), 3583E0CC8F78FD1E65F307D2D8471AD2 (batch file)
- [File Hashes] Lumma malware installer – C53eaf734ecc1d81c241ea2ab030a87e (NSIS installer file)
- [File Hashes] Vidar malware installer – 758625d112c04c094f96afc40eafa894 (NSIS installer file)
- [Command-and-Control URLs] Legion Loader – https[:]//guildish[.]com/diagnostics.php
- [Command-and-Control Domains] Lumma – metalsyo[.]digital, ironloxp[.]live, navstarx[.]shop, starcloc[.]bet, advennture[.]top, targett[.]top, spacedbv[.]world, Galxnetb[.]today
- [Command-and-Control Domains] Vidar – y.p.formaxprime.co[.]uk, e.p.formaxprime.co[.]uk, h.p.formaxprime.co[.]uk, p.p.formaxprime.co[.]uk, d.p.formaxprime.co[.]uk, s.p.formaxprime.co[.]uk, r.p.formaxprime.co[.]uk, t.p.formaxprime.co[.]uk, e.x.formaxprime.co[.]uk, steamcommunity[.]com/profiles/76561199832267488