{"id":100735,"date":"2025-06-12T14:30:58","date_gmt":"2025-06-12T14:30:58","guid":{"rendered":"https:\/\/ainalalam.com\/?p=100735"},"modified":"2025-06-12T14:30:58","modified_gmt":"2025-06-12T14:30:58","slug":"new-malware-posing-as-an-ai-assistant-steals-user-data","status":"publish","type":"post","link":"https:\/\/ainalalam.com\/?p=100735","title":{"rendered":"New malware posing as an AI assistant steals user data"},"content":{"rendered":"[mhc_section admin_label=”\u0642\u0633\u0645” fullwidth=”on” specialty=”off”][mhc_fullwidth_menu admin_label=”\u0642\u0627\u0626\u0645\u0629 \u0628\u0639\u0631\u0636 \u0643\u0627\u0645\u0644” menu_id=”56″ background_color=”#ffffff” background_layout=”light” text_orientation=”center” submenu_direction=”downwards” fullwidth_menu=”off”] [\/mhc_fullwidth_menu][\/mhc_section][mhc_section admin_label=”section” transparent_background=”off” gradient_background=”off” background_color=”#ffffff” gradient_style=”horizontal” inner_shadow=”on” parallax=”off” parallax_method=”off” video_hide=”off” video_pause=”off” allow_advanced_padding=”on” remove_padding=”on” force_fullwidth=”off” column_paddings=”padding-0pct” column_match_heights=”off” background_leak=”off” background_leak_color=”#ffffff” background_leak_size=”25″ separator_top=”off” separator_bottom=”off” background_image_size=”cover” background_image_repeat=”no-repeat” background_image_position_x=”center” background_image_position_y=”center” animation=”off” animation_color=”#ffffff” mobile_2_pr_row=”off” mobile_reverse=”off”][mhc_row admin_label=”row”][mhc_column type=”1_3″][mhc_image admin_label=”\u0635\u0648\u0631\u0629” src=”https:\/\/ainalalam.com\/wp-content\/uploads\/2024\/04\/ainlogo.png” show_in_lightbox=”off” url_new_window=”off” animation=”off” hoverfx=”scaleup” sticky=”off” image_mask=”off” border_radius=”0″ align=”center” force_center_on_mobile=”on” alt=”\u0645\u0648\u0642\u0639 \u0639\u064a\u0646 \u0627\u0644\u0639\u0627\u0644\u0645 \u0647\u0648 \u0645\u0648\u0642\u0639 \u062a\u0633\u0648\u064a\u0642\u064a \u0648\u0641\u0642 \u0648\u062b\u064a\u0642\u0629 \u0627\u0644\u0639\u0645\u0644 \u0627\u0644\u062d\u0631.”] [\/mhc_image][\/mhc_column][mhc_column type=”2_3″][mhc_ticker admin_label=”\u0634\u0631\u064a\u0637 \u0623\u062e\u0628\u0627\u0631” magazine_list=”date” offset_posts=”0″ ticker_title=”\u062c\u062f\u064a\u062f \u0627\u0644\u062a\u063a\u0637\u064a\u0627\u062a” background_layout=”dark” background=”#6d3a2a” show_thumbnail=”on” show_arrows=”on” auto=”off” fade=”fade” pause=”off”] [\/mhc_ticker][\/mhc_column][\/mhc_row][\/mhc_section][mhc_section admin_label=”\u0642\u0633\u0645” fullwidth=”on” specialty=”off” transparent_background=”off” gradient_background=”off” background_color=”#1e6eb5″ gradient_style=”horizontal” inner_shadow=”off” parallax=”off” parallax_method=”off” video_hide=”off” video_pause=”off” allow_advanced_padding=”off” remove_padding=”off” force_fullwidth=”off” column_paddings=”padding-0pct” column_match_heights=”off” background_leak=”off” background_leak_color=”#ffffff” background_leak_size=”50″ separator_top=”off” separator_bottom=”off” background_image_size=”cover” background_image_repeat=”no-repeat” background_image_position_x=”center” background_image_position_y=”center” animation=”off” animation_color=”#ffffff” mobile_2_pr_row=”off” mobile_reverse=”off”][mhc_fullwidth_search_bar admin_label=”\u0634\u0631\u064a\u0637 \u0628\u062d\u062b \u0628\u0639\u0631\u0636 \u0643\u0627\u0645\u0644” post_type=”all” show_terms=”off” terms_tax=”post_tag” placeholder=”\u0639\u064a\u0646 \u0627\u0644\u0639\u0627\u0644\u0645” icon_color=”#1e6eb5″ background_layout=”dark” border_radius=”6″ custom_paddings=”13px” animation=”off”] [\/mhc_fullwidth_search_bar][\/mhc_section][mhc_section admin_label=”\u0642\u0633\u0645” fullwidth=”on” specialty=”off” transparent_background=”off” gradient_background=”off” background_color=”#ffffff” gradient_style=”horizontal” inner_shadow=”off” parallax=”off” parallax_method=”off” video_hide=”off” video_pause=”off” allow_advanced_padding=”off” remove_padding=”off” force_fullwidth=”off” column_paddings=”padding-0pct” column_match_heights=”off” background_leak=”off” background_leak_color=”#ffffff” background_leak_size=”50″ separator_top=”off” separator_bottom=”off” background_image_size=”cover” background_image_repeat=”no-repeat” background_image_position_x=”center” background_image_position_y=”center” animation=”off” animation_color=”#ffffff” mobile_2_pr_row=”off” mobile_reverse=”off”][mhc_fullwidth_post_header admin_label=”\u0639\u0646\u0648\u0627\u0646 \u0627\u0644\u0645\u0642\u0627\u0644\u0629 \u0628\u0639\u0631\u0636 \u0643\u0627\u0645\u0644” title=”on” meta=”off” avatar=”on” author=”on” date=”on” categories=”on” comments=”off” views=”off” show_ratings=”off” show_excerpt=”off” show_share=”on” text_orientation=”center” text_color=”dark” featured_image=”on” featured_placement=”below” parallax=”off” parallax_method=”off” animation=”bouncein” custom_paddings=”40″ size=”26px” title_bold=”on” text_shadow=”off” text_background=”off” text_bg_color=”#ffffff” overlay=”on” bg_color=”rgba(255,255,255,0.81)”] [\/mhc_fullwidth_post_header][\/mhc_section][mhc_section admin_label=”\u0642\u0633\u0645” fullwidth=”off” specialty=”off” transparent_background=”off” gradient_background=”off” background_color=”#ffffff” gradient_style=”horizontal” inner_shadow=”off” parallax=”off” parallax_method=”off” video_hide=”off” video_pause=”off” allow_advanced_padding=”off” remove_padding=”off” force_fullwidth=”off” column_paddings=”padding-0pct” column_match_heights=”off” background_leak=”off” background_leak_color=”#ffffff” background_leak_size=”50″ separator_top=”off” separator_bottom=”off” background_image_size=”cover” background_image_repeat=”no-repeat” background_image_position_x=”center” background_image_position_y=”center” animation=”off” animation_color=”#ffffff” mobile_2_pr_row=”off” mobile_reverse=”off”][mhc_row admin_label=”\u0635\u0641”][mhc_column type=”1_3″][\/mhc_column][mhc_column type=”2_3″][mhc_text admin_label=”\u0646\u0635” background_layout=”light” text_orientation=”left” animation=”off”]\n

Ain Alalam – Rashad Iskandrni<\/p>\n

 <\/p>\n

Kaspersky Global Research & Analysis Team researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs. The previously unknown malware is delivered via a phishing site pretending to be the official DeepSeek homepage that is promoted via Google Ads. The goal of the attacks is to install BrowserVenom, a malware that configures web browsers on the victim\u2019s device to channel web traffic through the attackers servers, thus allowing to collect user data \u2013 credentials and other sensitive information. Multiple infections have been detected in Brazil, Cuba, Mexico, India, Nepal, South Africa and Egypt.<\/p>\n

DeepSeek-R1 is one of the most popular LLMs right now, and Kaspersky has previously reported attacks with malware<\/a> mimicking it to attract victims. DeepSeek can also be run offline on PCs using tools like Ollama or LM Studio, and attackers used this in their campaign.<\/p>\n

Users were directed to a phishing site mimicking the address of the original DeepSeek platform via Google Ads, with the link showing up in the ad when a user searched for \u201cdeepseek r1\u201d. Once the user reached the fake DeepSeek site, a check was performed to identify the victim\u2019s operating system. If it was Windows, the user was presented with a button to download the tools for working with the LLM offline. Other operating systems were not targeted at the time of research.<\/p>\n

\n

After clicking on the button and passing the CAPTCHA test, a malicious installer file was downloaded and the user was presented with options to download and install Ollama or LM Studio. If either option was chosen, along with legitimate Ollama or LM Studio installers, malware got installed in the system bypassing Windows Defender’s protection with a special algorithm. This procedure also required administrator privileges for the user profile on Windows; if the user profile on Windows did not have these privileges, the infection would not take place.<\/p>\n

\n

After the malware was installed, it configured all web browsers in the system to forcefully use a proxy controlled by the attackers, enabling them to spy on sensitive browsing data and monitor the victim’s browsing activity. Because of its enforcing nature and malicious intent, Kaspersky researchers have dubbed this malware BrowserVenom.<\/p>\n

\u201cWhile running large language models offline offers privacy benefits and reduces reliance on cloud services, it can also come with substantial risks if proper precautions aren\u2019t taken. Cybercriminals are increasingly exploiting the popularity of open-source AI tools by distributing malicious packages and fake installers that can covertly install keyloggers, cryptominers, or infostealers. These fake tools compromise a user\u2019s sensitive data and pose a threat, particularly when users have downloaded them from unverified sources,<\/em>\u201d comments Lisandro Ubiedo, Security Researcher with Kaspersky\u2019s Global Research & Analysis Team.<\/p>\n

To avoid such threats, Kaspersky recommends:<\/p>\n