This article details a sophisticated malvertising campaign impersonating the AI media generation platform Kling AI to distribute infostealing malware globally, primarily in Asia. The threat actors utilized deceptive filenames with Hangul filler characters and .NET Native AOT loaders to evade detection while stealing credentials from browsers, crypto wallets, and financial apps. #KlingAI #Malvertising #Infostealer #PureHVNC #Cybersecurity
Keypoints
- The campaign impersonated the popular AI media platform Kling AI, using fake Facebook pages and paid ads to lure users to malicious, spoofed websites.
- Downloaded “media” files were in fact disguised executables with filenames masked by Hangul filler characters and double extensions (e.g., .jpg, .mp4) to evade user suspicion.
- Loaders were often developed in .NET, with some compiled using Native AOT for stealth and packed with anti-analysis techniques targeting common forensic tools.
- Once executed, these loaders established persistence by using registry run keys and injected second-stage payloads into legitimate system processes to avoid detection.
- The main payload was PureHVNC, a .NET Remote Access Trojan with advanced infostealing capabilities targeting credentials from browsers, crypto wallet extensions, and financial software.
- The threat actor monitored a wide range of Chromium-based browsers and popular crypto wallets, as well as banking and financial applications, to capture sensitive data.
- Attribution points to Vietnamese actors, supported by Vietnamese language artifacts in code and ads, and confirmed by known patterns in malvertising campaigns.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – Loader executed disguised binaries with obfuscated filenames (‘…files carry extensions like .mp4 or .jpg but are disguised Windows executables…’).
- [T1071] Application Layer Protocol – PureHVNC RAT communicated with C2 servers using encoded gzip-compressed configuration blobs containing IPs and campaign IDs (‘…configuration blob reveals C2 IP address, campaign ID…’).
- [T1105] Ingress Tool Transfer – The campaign staged payloads by downloading and unpacking ZIP archives containing malicious executables (‘…the generated result is a zip archive containing a single .exe file…’).
- [T1218] Signed Binary Proxy Execution – Loaders injected second stage into legitimate signed system processes like InstallUtil.exe to evade detection (‘…injects the 2nd stage into hardcoded legitimate system processes like InstallUtil.exe…’).
- [T1140] Deobfuscate/Decode Files or Information – Second stage payloads were obfuscated with .NET Reactor and required deobfuscation (‘…second stage is obfuscated with .NET Reactor…’).
- [T1057] Process Discovery – Loader detected running analysis/debugging processes to evade sandboxing and forensic analysis (‘…if any of these programs are found running in memory, the loader immediately exits…’).
- [T1547] Boot or Logon Autostart Execution – The loader established persistence using registry run keys and copied itself to %APPDATA% paths (‘…for persistence, the loader sets up a run key in the registry and copies the loader file…’).
- [T1113] Screen Capture – The ‘PluginWindowNotify’ plugin captured screenshots of targeted foreground windows with specific keywords (‘…plugin takes screenshots of foreground windows matching keywords…’).
Indicators of Compromise
- [SHA-256 Hashes] Stage 1 loaders – F5B31BD394E0A3ADB6BD175207B8C3CCC51850C8F2CEE1149A8421736168E13E, F89298933FED52511BB78F8F377979190E37367D72CCF4F3B81374A70362CC42, and 15 more.
- [SHA-256 Hashes] Stage 2 PureHVNC RAT – B33E162A78B7B8E7DBBAB5D1572D63814077FA524067CE79C37F52441B8BD384, 0C9228983FBD928AC94C057A00D744D6BE4BD4C1B39D1465B7D955B7D35BF496, plus others.
- [SHA-256 Hashes] Plugin – 1E66EBAEF295C2A32245162979D167CEBAD1FECE51B7CDB6A6C3A1D705BEFA6B.
- [Domains] Fake Kling AI websites – klingaimedia[.]com, klingaistudio[.]com, klingaieditor[.]com, kingaimediapro[.]com, kingaivideotext[.]com, kingaiplus[.]com.
- [URLs/Fake Facebook pages] Facebook malvertising pages – https://www.facebook[.]com/61574724896485/, https://www.facebook[.]com/61574162357787/, https://www.facebook[.]com/people/KLING-AI/61574316153107/.
- [IP Addresses] Command and Control servers – 185.149.232[.]197, 185.149.232[.]221, 147.135.244[.]43.
Read more: https://research.checkpoint.com/2025/impersonated-kling-ai-site-installs-malware/