Hackers are abusing fake AI websites impersonating legitimate AI video generator tools to infect users with infostealer malware and backdoors around the world. The campaign is being run by a Vietnamese hacking group dubbed UNC6032 and has been active since at least mid-2024.
The campaign was observed by security researchers at Mandiant, who claim they’ve discovered at least 30 different fake websites impersonating tools like Luma IA, Canva Dream Lab, and Kling AI, among others. The sites are being promoted via a network of over 120 misleading social media ads reaching millions globally, including over 2.3 million in the European Union alone.
Once the visitor generates their video, they’re provided the result as a downloadable ZIP file. This ZIP file then uses a double extension file, which looks like an MP4 video but is actually an executable that relies on DLL side-loading, to deliver a Rust-based malware dropper called Starkveil. The loader then executes the Coilhatch launcher, deploying XWorm and Forstrift backdoors along with Grimpull.
XWorm and Frostrift collect system information, including but not limited to usernames, OS details, hardware IDs and identifiers, and the anti-virus program running on the system. XWorm specifically can also log keystrokes, while Frostrift checks for specific messaging apps, browsers, and browser extensions to steal data.
Since the ads are run on popular social media platforms, including Facebook and LinkedIn, the target audience for this malware goes beyond typical graphics designers or video editors looking to offload some of their work to AI. Any unsuspecting user wanting to try out a trending AI content generation tool can fall victim to the attack.
The best way to avoid such infections is to cross-check the URLs of the website you’re using. You should also prevent clicking on sponsored links or ads that appear in Google searches, as attackers have been known to show legitimate URLs but redirect a user to a fake website anyway. Enabling file extensions in Windows is also a good way to quickly checking whether a file is actually what it appears to be instead of being a hidden double-extension executable.
In the News: OneDrive bug exposes your storage to third-party apps
