AI-Assisted Malware Campaign Distributed Through Fake Software Downloads

Researchers reported a large-scale malware distribution campaign that used fake software offerings hosted on trusted platforms to infect users, with operators increasingly relying on AI-assisted or “vibe-coded” development to scale payload creation. McAfee identified more than 443 malicious ZIP archives masquerading as AI tools, game cheats, VPNs, drivers, and decryptors, distributed via services including Discord, SourceForge, FOSSHub, MediaFire, and mydofiles.com. The campaign used 48 variants of WinUpdateHelper.dll across 17 kill chains, each with separate command-and-control infrastructure but linked through shared cryptocurrency wallet credentials, allowing researchers to trace monetization activity and victim distribution across countries including the US, UK, India, Brazil, France, Canada, and Australia.

A separate but related report described another multi-stage malware campaign that also relied on deceptive delivery and evasion, using .NET Ahead-of-Time (AOT) compilation to hinder analysis and a host-scoring system to avoid sandboxes and low-value targets. In that intrusion chain, a phishing-delivered ZIP launched KeyAuth.exe, which fetched bound_build.exe and then deployed both the Rhadamanthys infostealer and an XMRig miner disguised as MicrosoftEdgeUpdater. The malware checked conditions such as RAM, uptime, document count, and active antivirus processes, and terminated itself if the environment scored below a threshold, showing a deliberate effort to evade detection while maximizing successful infections.