Watch out for Facebook advertisements for AI products. They might be malware undercover.

The tech industry is currently experiencing a surge of excitement surrounding generative AI, leading to a proliferation of new and intriguing AI tools that encourage everyday users to explore the latest software offerings.

However, the popularity of AI does not guarantee the legitimacy of every tool available. In fact, the opposite is often true. Malicious actors frequently seek to exploit trending technologies, and the current AI boom has made potential users particularly susceptible to cybercriminals and fraudsters.

A recent report from Trend Micro highlights how these bad actors are employing a familiar tactic: leveraging Facebook ads to entice AI enthusiasts into downloading malware disguised as AI photo editing applications.

Malware masquerading as AI applications

TechKelly has previously covered how cybercriminals exploit compromised Facebook accounts to defraud victims.

These scammers have utilized Facebook ads to promote products that they fail to deliver. By hijacking legitimate Facebook pages and rebranding them to resemble official accounts from reputable companies like Google and Meta, they deceive users into downloading harmful software.

Now, these malicious individuals are refining their approach by masquerading as AI image-editing applications to disseminate malware.

According to the Trend Micro report, scammers are employing basic phishing techniques to trick page owners into revealing their login information. Once they gain access to an established account, they rebrand the Facebook page as an AI photo editing tool. In one instance examined by Trend Micro, the scammers impersonated Evoto, a legitimate AI photo editing service.

After rebranding the compromised pages as Evoto, the scammers initiated paid Facebook advertising campaigns, directing users to a fraudulent website where they could supposedly download the AI photo editing tool. In reality, the unsuspecting victims are not downloading AI software; instead, they are inadvertently installing endpoint management software that grants the attackers remote access.

Thank you for reading this post, don't forget to follow my whatsapp channel