AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
Microsoft says attackers are using AI chatbot answers and SEO poisoning to steer users to cryptojacking malware sites disguised as utilities.
Intelligence analysis by GPT-5.4 Mini
Microsoft says a cryptojacking campaign is abusing AI chatbot recommendations to push malicious download sites that impersonate trusted Windows utilities. The operation uses ScreenConnect for persistence and follow-on access, and appears tuned to infect high-value GPU systems.
Some bad actors are hiding fake software download pages and using AI chat tools to point people at them. When someone clicks and installs the wrong file, the computer can start secretly making crypto money for the attackers.
It is like asking for directions to a real store and getting sent to a fake one with the same sign. The fake store looks normal, but inside it hands out a bad package that sneaks into the house.
Microsoft says the attackers also leave a back door open, so they can come back later. That makes the problem bigger than just stolen computer power, because they may also steal files or move around the network.
Analysis
What Microsoft found
Microsoft says it has been tracking an active cryptojacking campaign that uses AI chatbot interactions as a delivery path for malicious software. Instead of relying only on conventional search results, the attackers appear to be steering users toward attacker-controlled download sites through generated chatbot responses and SEO-poisoned pages.
How the lure works
The malicious sites imitate well-known utilities such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. That choice suggests the campaign is trying to reach users with high-performance GPUs, since those machines are more valuable for mining cryptocurrency. Microsoft says it identified more than 150 malicious domains tied to the activity.
The download flow delivers a ZIP archive containing a legitimate executable and a rogue DLL. When launched, the DLL sideloads a second malicious DLL, which installs ScreenConnect. Once installed, ScreenConnect repeatedly contacts an attacker-controlled server and is used to run a payload Microsoft calls SimpleRunPE.exe.
What the payload does
Microsoft says the payload creates persistence through Registry Run keys and scheduled tasks, adds Microsoft Defender exclusions, runs anti-analysis checks, and uses process hollowing to run mining code under a trusted Microsoft-signed binary. In some cases, PowerShell is used to fetch the binary, rename it to look like VLC, create a scheduled task, and remove the script afterward.
The malware supports gminer, lolMiner, and SRBMiner-MULTI, and it can terminate itself if it detects analysis tools such as Task Manager, Process Hacker, Process Explorer, or System Informer. Microsoft says the campaign is not just about mining; the ScreenConnect foothold can also support data theft, lateral movement, or ransomware.
Key points
- Microsoft says attackers are using AI chatbot responses to direct users to malware download sites.
- The fake sites impersonate trusted utilities and appear aimed at GPU-rich systems.
- The downloaded package uses DLL sideloading to install ScreenConnect and establish persistence.
- The payload can deploy miners including gminer, lolMiner, and SRBMiner-MULTI.
- Microsoft says the same access could support data theft, lateral movement, or ransomware.
