EvilAI Malware Campaign Exploits Trust in AI Tools to Infiltrate Global Industries

Trend Micro researchers have uncovered a sophisticated malware campaign dubbed EvilAI, which disguises itself as productivity and AI-enhanced tools to infiltrate organisations worldwide, with a global footprint spanning manufacturing, government, and healthcare. According to Trend Micro, EvilAI uses professional-looking interfaces and valid digital signatures that make it difficult for users and security tools to distinguish it from legitimate software.

The campaign relies on generic app names such as App Suite, Epi Browser, Manual Finder and Recipe Lister, delivering basic functionality to lull users into a false sense of security while a hidden payload exfiltrates data. In the first week of telemetry starting 29 August 2025, infections appeared globally, with the highest impact in Europe (56 incidents), the Americas (29) and AMEA (29).

Country data show India leading with 74 cases, followed by the United States (68) and France (58); Europe, the Americas and AMEA sectors report manufacturing, government/public services and healthcare as the hardest hit, respectively. EvilAI blends stealth, persistence and AI-driven evasion through real features, code-signing abuse, node.js payload execution, scheduled tasks and registry Run keys, plus encrypted C2 communication and credential theft from Chrome and Edge profiles.