AI brands as bait: How threat actors are using the AI hype in social engineering

Key Points:

• Threat actors are leveraging AI-themed social engineering tactics, impersonating popular AI brands like ChatGPT and Claude to execute phishing and malvertising campaigns.
• These campaigns have resulted in credential theft, financial fraud, and malware infections across various sectors, with significant impacts observed in South Africa, the US, and Europe.
• Recommended actions include implementing multi-factor authentication (MFA), utilizing Microsoft Defender's advanced threat detection capabilities, and configuring automatic attack disruption to mitigate risks.

Technical Details: Recent campaigns have utilized malicious URLs leading to phishing pages that collect sensitive information. Notably, the initial access broker Storm-3075 has been linked to these attacks, deploying malware such as Vidar Stealer through AI-themed lures.

MITRE ATT&CK Techniques:

• T1566 - Phishing (Initial Access)
• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1003.001 - OS Credential Dumping: LSASS Memory (Credential Access)

IOCs Mentioned:

• SHA-256 File hash for attachment: 791efb555eefb7215e96659a1353a97416743b66bdd72705493129c64057d40e
• URL inside the PDF attachment: hxxp://dash.awaydouble[.]org/0v2auth
• URL for fraudulent GitHub repository hosting malware executable: hxxps://github[.]com/shippingtechnologymovie/AI-techVideos/releases/download/13123/ProFluxeFlowAi-win-Setup.exe
• SHA-256 for ProFluxeFlowAi-win-Setup.exe: c7c5072df9f83f4c440a5c3bb4be1d5f6c67bbf78f196406ca20d27b43b975b8

This summary provides actionable intelligence on the evolving threat landscape involving AI-themed social engineering tactics. Security teams should prioritize implementing recommended mitigations to reduce exposure to these sophisticated attacks.