Threat actors are leveraging legitimate-looking AI tools and software to stealthily deliver malware on a global scale. This campaign, dubbed EvilAI, targets various sectors and regions by disguising malicious activities behind authentic digital signatures and convincingly benign applications. #EvilAI #BaoLoader
Keypoints
- Threat actors use AI-enhanced tools to distribute malware globally across multiple industries and regions.
- The EvilAI campaign employs signed applications with convincing interfaces to evade detection and deceive users.
- These malicious programs establish persistence, conduct reconnaissance, and exfiltrate sensitive data through encrypted channels.
- Attackers manipulate SEO, use malicious ads, and mimic vendor portals to propagate their malware.
- The campaign exploits digital code signing and covert encoding techniques to bypass security defenses and maintain ongoing threats.
Read More: https://thehackernews.com/2025/09/evilai-malware-masquerades-as-ai-tools.html