GPU mining malware spreads via SEO poisoning, AI chatbots
In an ongoing cryptojacking campaign, threat actors are targeting high-performance computer systems through a coordinated SEO poisoning operation that also manipulates AI chatbot recommendations.
Malicious download pages for utility programs like CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear—which are usually installed by owners of powerful systems—cause the compromise.
Once a system is compromised, the attacker can install more malware by using the official remote management ScreenConnect program to gain permanent access to the device.
The attack starts when users search for one of the aforementioned utilities and are sent malicious links that have been enhanced in search ranks using SEO poisoning, according to Microsoft research...