Threat actors have been observed using seemingly legitimate artificial intelligence (AI) tools and software to sneakily slip malware for future attacks on organizations worldwide. According to Trend Micro, the campaign is using supposed productivity or AI-enhanced tools to deliver malicious payloads across multiple regions, including Europe, the Americas, and the Asia, Middle East, and Africa (AMEA) area. The top sectors affected by these attacks are manufacturing, government, healthcare, technology, and retail. With infections reported in countries like India, the U.S., France, Italy, Brazil, Germany, the U.K., Norway, Spain, and Canada, the campaign demonstrates a significant global reach. Security researchers have codenamed this widespread operation EvilAI, noting that the attackers are "highly capable" because they are masters at blurring the line between authentic and deceptive software, concealing malicious features within applications that appear functional.
The campaign distributes various trojans disguised as useful programs, including AppSuite, Epi Browser, JustAskJacky, Manual Finder, OneStart, PDF Editor, Recipe Lister, and Tampered Chef. The deception is remarkably thorough, featuring professional-looking interfaces and even using signing certificates from disposable companies to give the files a false sense of legitimacy, with new signatures issued as older ones are revoked. Trend Micro noted that EvilAI's professional appearance makes it difficult for both users and security tools to distinguish it from genuine software. The ultimate goal of the campaign is extensive reconnaissance, stealing sensitive browser data, and maintaining encrypted, real-time communication with its command and control (C2) servers using AES-encrypted channels to receive further commands and deploy additional payloads.
The malware spreads through several methods, including creating newly registered websites that mimic vendor portals, malicious advertisements, search engine optimization (SEO) manipulation, and promoted download links on forums and social media. EvilAI primarily functions as a stager, meaning its main purpose is to gain initial access, establish persistence, and prepare the infected system for later, more powerful payloads. It actively takes steps to enumerate installed security software and complicate analysis, avoiding reliance on obviously malicious files. This dual-purpose approach ensures the user's expectation of a working app is met, further lowering any suspicion.
Further analysis by other security firms confirms the campaign's complexity. G DATA determined that the threat actors behind AppSuite, ManualFinder, and OneStart are the same and share server infrastructure for distribution and configuration. Expel found that the developers behind AppSuite and PDF Editor have used at least 26 code-signing certificates issued to companies in Panama and Malaysia over the last seven years to make their software appear legitimate. Expel tracks this specific type of signed malware as BaoLoader, noting differences from the TamperedChef strain, which used certificates issued in Ukraine and Great Britain.
More recent findings by Field Effect and GuidePoint Security uncovered additional digitally signed binaries disguised as calendar and image viewer tools. These tools utilize the NeutralinoJS desktop framework to execute arbitrary JavaScript code and interact with native system APIs, allowing for covert file system access, process spawning, and network communication. The malware also cleverly uses Unicode homoglyphs to encode payloads within seemingly benign API responses, enabling it to bypass string-based detection and signature matching. Field Effect concluded that the campaign illustrates how threat actors are evolving their delivery mechanisms by weaponizing potentially unwanted applications, abusing digital code signing, and deploying covert encoding techniques, ultimately allowing malware to masquerade as legitimate software and exploit user trust.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
