A threat actor known as BatLoader has been observed running malicious campaigns using Google Search Ads to deliver fake ChatGPT and Midjourney web pages.
A security researcher at eSentire’s Threat Response Unit (TRU) described the campaign in an advisory published Tuesday.
“[ChatGPT and Midjourney] Although very popular, there is no first-party standalone app (i.e. users interface with ChatGPT via a web interface while Midjourney uses Discord),” the technical document reads. . “This void is being exploited by attackers in an attempt to drive people seeking AI apps into creating fake web pages of him promoting fake apps.”
You can read more about similar attacks here: ChatGPT-related malicious URLs on the rise
eSentire also explained that in its latest campaign impersonating ChatGPT, BatLoader uses MSIX Windows App Installer files to infect devices with Redline Stealer.
Installation involves running executables and PowerShell scripts. This will install and run Redline Stealer. The script also executes her two requests to her C2 panel, records the start time and her IP address of the victim, and documents successful payload installation.
eSentire explained that this technology highlights BatLoader’s ability to abuse legitimate application package formats for malicious purposes. Additionally, this threat actor has a history of targeting users searching for AI tools, as evidenced by his discovery of a newly registered BatLoader domain by TRU in February 2023.
In May 2023, TRU encountered another instance of similar infection tactics involving a Midjourney fake page. A user was asked to download a Windows application package signed by “Ashana Global Ltd.”.
Read more: Mass Adoption of Generative AI Accelerates Regulatory Planning
The installation process involved running the same obfuscated PowerShell script used in the previous case, but using a different command and control (C2) domain.
“Generative AI technologies and chatbots have exploded in popularity in 2023. Unfortunately, as system administrators seek ways to control access to these platforms, users are We may seek alternatives,” the recommendation reads.
To protect against these threats, eSentire raises awareness of malware masquerading as legitimate applications, ensures endpoint protection with the latest antivirus signatures and next-generation AV or EDR solutions, and protects packaged apps from recommended that you consider implementing Windows Defender Application Control to manage
Editorial image credit: iama_sing / Shutterstock.com
