Friday, December 1, 2023

Poisoned Facebook Ads Deliver Malware Using Fake ChatGPT, Bard & Other AI Services

Cyber criminals have recently started using Facebook to pretend to be well-known generative AI brands like ChatGPT, Google Bard, Midjourney, and Jasper to steal users’ personal information.

Users on Facebook are deceived into downloading content from fake brand sites and advertisements.

These downloads contain harmful malware that steals users’ internet credentials for banking, social networking, gaming, and other services, their cryptocurrency wallets, and any data saved in their browsers.

According to the Check Point Research Team (CPR), the majority of Facebook campaigns that use fake sites and dangerous advertisements eventually spread malware that steals information.

Users who are not aware of the situation are liking and commenting on fake posts, spreading them to their social networks.

How Criminals Use Facebook Ads to Steal Private Information?

This new scam makes use of people’s curiosity about popular generative AI apps to trick them out of their passwords and sensitive data.

The intruders begin by making fake Facebook pages or groups for well-known brands and adding interesting content to them. The unaware individual comments on or likes the content, guaranteeing that it appears on their friends’ news feeds. 

Through a link, the false page advertises a new service. When the user clicks on the link, malicious malware that is intended to steal their internet passwords, cryptocurrency wallets, and other information saved in their browser is unknowingly downloaded.

“Many of the fake pages offer tips, news, and enhanced versions of AI services Google Bard or ChatGPT”, researchers said.

Fake posts displayed to the users

Additionally, cyber criminals frequently persuade users to utilize other AI services and tools. Jasper AI is another well-known AI brand that has amassed over 2 million followers and is being impersonated by online crooks.

Jasper AI impersonated by cyber criminals

In reality, people are furiously debating the role of AI in the comments and liking/sharing the posts, which increases their reach.

“Most of those Facebook pages lead to similar type landing pages which encourage users to download password-protected archive files that are allegedly related to generative AI engines”, say the researchers.

Notably say, when an ignorant user looks for ‘Midjourney AI’ on Facebook and comes across a page with 1.2 million followers, they are likely to assume it is genuine.

Researchers mention that the main goal of this fake Mid-Journey AI Facebook page is to mislead visitors into downloading malware. Links to malicious websites are combined with links to authentic Midjourney reviews or social networks to offer credibility.

“The malware makes efforts to gather various types of information from all the major browsers, including cookies, bookmarks, browsing history, and passwords,” researchers.

“It targets cryptocurrency wallets including Zcash, Bitcoin, Ethereum, and others.”

Final Thoughts

The primary objective of cybercriminals seems to be information related to Facebook accounts and the theft of Facebook pages. Even many pages with a wide audience might be used in this way to propagate fraud since cybercriminals are seeking to take advantage of pages with significant audiences and advertising budgets already in place.

Individuals and organizations must thus educate themselves, be aware of the hazards, and maintain vigilance against the strategies used by cybercriminals. To defend against these changing dangers, advanced security solutions are still crucial.

Stay up-to-date with the latest Cyber Security News; follow us on GoogleNewsLinkedinTwitterand Facebook.


Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles