TrendAI™ Research tracked a sustained malvertising campaign that abused Google Ads to deliver ClickFix social engineering attacks disguised as popular AI developer tools. The campaign impersonated at least six legitimate brand names, including ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, Claude AI, and claude.ai, and simultaneously ran Mac utility scam lures.
By leveraging paid search ads targeting users actively seeking AI development tools, the attackers were able to target technically proficient users who are more likely to interact with command-line instructions without suspicion. This marks a sophisticated evolution of the ClickFix social engineering technique, where victims are tricked into manually executing malicious commands, typically by copying and pasting PowerShell or terminal commands under the guise of “fixing” a problem or completing a software installation.
Read more…
Source: Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script
March 26, 2024
Since its discovery in 2022, the Agenda Ransomware group (also known as Qilin) has been active and in development. Agenda, which Trend Micro tracks as Water Galura, continues infecting victims globally with the US, Argentina, and Australia, and Thailand being among its top targets (based on the threat actor’s leak site data). Meanwhile the Agenda ransomware ...
- Secure by Design Alert Eliminating SQL Injection Vulnerabilities in Software
March 25, 2024
SQL injection – or SQLi – vulnerabilities remain a persistent class of defect in commercial software products. Despite widespread knowledge and documentation of SQLi vulnerabilities over the past two decades, along with the availability of effective mitigations, software manufacturers have continued to develop products with this defect, which puts many customers at risk. CISA and the ...
- Air Europa says customer data may have been compromised in October breach
March 22, 2024
Spanish airline Air Europa said on Friday personal data of its customers may have been compromised in a security incident that was detected in October last year. The company’s investigation showed that name, ID card or passport details, date of birth, telephone number, email address and nationality details could have been leaked, Air Europa told its ...
- Ring doorbell owners warned of bank raiding attack as thieves target Brits
March 21, 2024
Home security gadgets like Ring doorbells are increasingly being targeted by cyber crooks and their nasty phishing campaigns. Cybersecurity experts at Trustwave have warned Ring customers – and owners of similar gadgets from other brands – that home security tech is being used against the people its supposed to protect. Read more… Source: The Sun
- China’s MSS publicizes typical case to remind public of overseas cyber ransom attacks
March 21, 2024
China’s national security authorities publicized on Thursday a typical case of cyber ransom attacks to help raise public awareness over online blackmail and attacks from overseas, which not only affects social stability and economic development but also threatens China’s national security and interests. A Chinese high-tech company recently filed a report through the hotline 12339 about ...
- Android malware, Android malware and more Android malware
March 20, 2024
Among the mobile platforms, Android remains the most popular target operating system for cybercriminals. Last month, Kaspersky wrote a total of four private crimeware reports on Android malware, three of which are summarized below. Tambir Tambir is an Android backdoor that targets users in Turkey. It disguises itself as an IPTV app, but does not manifest any ...