EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

Threat actors are seen deploying EvilAI, a campaign that masquerades as legitimate AI and productivity tools to slip malware into organisations worldwide, according to Trend Micro. The campaign targets Europe, the Americas, and the AMEA region, with sectors including manufacturing, government, healthcare, technology, and retail repeatedly affected, and India, the U.S., France, Italy, Brazil, Germany, the U.K., Norway, Spain, and Canada among the most infected.

Tools distributed under this umbrella include AppSuite, Epi Browser, JustAskJacky, Manual Finder, OneStart, PDF Editor, Recipe Lister, and Tampered Chef, with Expel, G DATA, and TRUESEC having documented parts of the activity last month. Signatures are reinforced by code-signing certificates from disposable companies, enabling the malware to appear legitimate, and the activity is tracked under BaoLoader, distinguished from TamperedChef by Expel.

Trend Micro describes the attackers as “highly capable” and notes that EvilAI acts as a stager to gain initial access, maintain persistence, and prepare infected systems for additional payloads, while using AES-encrypted channels for C2 communications. Additional analyses from Field Effect and GuidePoint Security have found more signed binaries masquerading as calendar and image viewer tools, sometimes using the NeutralinoJS framework to execute JavaScript and siphon data.