EvilAI: Leveraging AI to Steal Browser Data and Evade Detection

EvilAI is a new malware family tracked by Trend™ Research that has emerged in recent weeks, disguising itself as legitimate AI-driven utilities. According to Trend™ Research, they began tracking EvilAI on August 29 and observed a global wave of infections within just one week, with Europe leading in detections (56) followed by the Americas (29) and AMEA (29).

The campaigns show a broad footprint, hitting countries such as India (74), the United States (68), and France (58), and the attackers appear to be well resourced given their distribution and obfuscation techniques. Installers use generic names like App Suite, PDF Editor, and JustAskJacky to avoid brand imitation, and the code is delivered by a Node.js–based payload that exfiltrates sensitive browser data via encrypted HTTPS POSTs to a C&C server, after terminating Chrome and Edge processes to obtain handles.

Defenders are urged to deploy AI-aware protections, scrutinise code-signing, and implement layered measures such as behavioural analytics and real-time monitoring to disrupt data theft and persistence.