AI-Enhanced Malware Sports Super-Stealthy Tactics

According to Trend Micro, a threat actor is using legit-looking AI tools and software to sneak malware for future attacks on organisations worldwide, in a campaign tracked as "EvilAI" that has already affected hundreds of victims across manufacturing, government, healthcare and more, with victims in the US, India, the UK, Germany, France, Brazil and beyond.

The operation is described as fast-moving, leveraging AI, digital signatures and highly realistic features to avoid easy detection, with one week of monitoring revealing aggressive and rapid spread. The threat actors conceal malware in seemingly authentic productivity and AI-enhanced apps such as App Suite, Epi Browser JustAskJacky, Manual Finder and Tampered Chef, using professional-looking interfaces and working features to bolster plausibility.

Trend Micro notes the attackers sign their apps with code-signing certificates from newly registered entities, often via disposable companies that issue certificates for signing malware. Once installed, the apps conduct extensive reconnaissance, terminate browser processes, try to disable security products from vendors like Bitdefender, Kaspersky and Fortinet, and use obfuscation and persistence techniques to remain hidden.