Malicious Hackers Create Fake AI Tool to Exploit Millions of Users

A concerning development in the field of cybersecurity is the initiation of a sophisticated campaign by hostile actors posing as Kling AI, a well-known AI-powered picture and video synthesis platform that has amassed 6 million users since its June 2024 launch.

According to the Report , Uncovered by Check Point Research (CPR) in early 2025, this global threat leverages the growing fascination with generative AI tools to deceive unsuspecting users.

By mimicking the legitimate Kling AI service through counterfeit Facebook pages and paid advertisements, attackers drive traffic to a convincingly spoofed website.

Here, users are lured into downloading what they believe to be harmless media files, only to execute malicious Windows executables disguised with double extensions and Hangul Filler characters, a tactic designed to obscure the true nature of the files in standard file explorers.

Deceptive Campaign Targets AI Enthusiasts Worldwide

The infection chain begins with malvertising on social media, where approximately 70 fake posts and pages, such as klingaimedia[.]com, replicate Kling AI’s branding.

Once users interact with the fake site uploading images or generating content they are prompted to download a supposed output file, often presented as a .jpg or .mp4 within a zip archive.

In reality, these are executable files with filenames inflated to 292 bytes using UTF-8 encoded Hangul Filler characters, masking their identity as applications.

Upon execution, a first-stage loader, frequently developed in .NET and compiled with Native AOT to evade detection, deploys anti-analysis tricks, checking for virtual environments and tools like Wireshark or Procmon.

It establishes persistence via registry run keys and injects a second-stage payload, identified as the PureHVNC Remote Access Trojan (RAT), into legitimate system processes like InstallUtil.exe.

This RAT, often obfuscated with .NET Reactor, is equipped with extensive infostealing capabilities, targeting credentials and session tokens from a wide array of browser extensions such as MetaMask, Trust Wallet, and Coinbase Wallet and standalone applications like Exodus and Atomic Wallet across multiple Chromium-based browsers.

Sophisticated Malware Evades Detection

What makes this campaign particularly alarming is its technical sophistication and global reach, with victims reported predominantly in Asia.

The loaders incorporate anti-virtualization checks and self-deletion mechanisms, while the RAT’s plugins, like PluginWindowNotify, monitor foreground windows for keywords related to crypto wallets and banking, capturing screenshots for operators.

Additionally, decoded configuration blobs reveal Command and Control (C2) IP addresses and campaign identifiers like “Kling AI 25/03/2025,” alongside embedded certificates.

Attribution points to Vietnamese threat actors, evidenced by debug messages and advertiser details in the Vietnamese language, aligning with historical patterns of similar malvertising schemes.

Check Point Harmony Endpoint and Threat Emulation offer protection against these tactics, but the evolving exploitation of trust in AI platforms underscores a critical need for user vigilance.

Indicators of Compromise (IOCs)

Category	Indicator
Stage 1 Loaders (SHA-256)	F5B31BD394E0A3ADB6BD175207B8C3CCC51850C8F2CEE1149A8421736168E13E, … (shortened for brevity)
Stage 2 PureHVNC (SHA-256)	B33E162A78B7B8E7DBBAB5D1572D63814077FA524067CE79C37F52441B8BD384, … (shortened for brevity)
Plugins (SHA-256)	1E66EBAEF295C2A32245162979D167CEBAD1FECE51B7CDB6A6C3A1D705BEFA6B
Fake Websites	klingaimedia[.]com, klingaistudio[.]com, klingaieditor[.]com, etc.
C2 IPs	185.149.232[.]197, 185.149.232[.]221, 147.135.244[.]43

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!