AI-Themed Attacks Escalate, Leveraging Trust in ChatGPT and Copilot
Cybercriminals are increasingly impersonating popular AI platforms like ChatGPT and Copilot to conduct phishing, malvertising, and malware distribution campaigns.
Microsoft Threat Intelligence has identified a significant rise in cyberattacks that exploit the public's trust and curiosity in artificial intelligence, specifically by impersonating well-known AI services such as ChatGPT, Microsoft Copilot, DeepSeek, and Claude. These campaigns are not a reflection of vulnerabilities within the AI platforms themselves, but rather a strategic exploitation of their brand recognition and the inherent trust users place in them. Attackers are leveraging these AI themes to make their malicious activities, including phishing, search-driven malware campaigns, and malvertising, appear more legitimate and convincing.
A particularly concerning example highlighted by Microsoft involved a ChatGPT-themed phishing campaign that sent as many as 100,000 emails in a single day. These emails tricked recipients into believing they needed to update their ChatGPT Plus payment information, ultimately leading to the theft of personal data and credit card details. This tactic underscores a broader trend where threat actors are borrowing the credibility of emerging technologies to lower user defenses. The current excitement and widespread adoption of AI tools create a fertile ground for such social engineering tactics, preying on users' eagerness to explore new AI capabilities or respond to urgent-seeming notifications.
The attack methodologies employed are not novel but are rather familiar tactics—urgency, curiosity, and impersonation—wrapped in a new, AI-centric guise. Messages about new AI model releases, policy updates from AI assistants, or plugins promising enhanced productivity are now the digital equivalent of traditional fake invoices or shipping notifications. The enduring appeal of AI, coupled with human curiosity and the desire for efficiency, makes these AI-themed lures particularly effective and persistent. This trend warrants close attention from security teams as it represents a significant evolution in how threat actors leverage public interest in technology.
Microsoft's research has detailed several specific AI-themed campaigns. These include a ChatGPT-themed phishing kit designed to harvest credit card information, a Claude-themed campaign utilizing adversary-in-the-middle (AiTM) techniques to steal credentials and access tokens, and malvertising campaigns distributing the Vidar stealer through fake AI Windows plugins. Furthermore, fraudulent installers for DeepSeek have been observed being distributed via GitHub. In one instance, an initial access broker known as Storm-3075 employed AI-themed malvertising to distribute payloads for various other threat actors, indicating the rapid commoditization of this attack vector across the criminal ecosystem.
What connects these diverse campaigns is not necessarily technical sophistication, but rather a patient and precise exploitation of current trends and user psychology. Threat actors are adept at capitalizing on anticipated AI product launches and emerging trends, often employing multi-stage redirection chains and ephemeral infrastructure to evade detection by both users and security systems. This necessitates a holistic approach to security, where organizations must view a single AI-themed lure not as an isolated incident but as a potential precursor to a multi-stage attack that could span from initial email contact to identity and endpoint compromise.
Microsoft Defender offers a suite of capabilities to detect and disrupt these AI-themed threats. Pre-delivery protections include anti-phishing policies that can identify spoofing and impersonation attempts, such as fake "Copilot policy update" notifications or lookalike domains. Safe Links technology scans and detonates URLs in real-time, providing protection against malicious links and redirect chains. For campaigns involving malicious downloads or attachments, Safe Attachments analyzes files in a sandboxed environment before they reach the user.
Beyond initial detection, Microsoft Defender provides post-delivery filtering to remove malicious content from mailboxes and limit exposure. Crucially, for multi-stage attacks that extend beyond email, Defender correlates signals from various sources—including endpoints, identities, and SaaS applications—to reconstruct the complete attack narrative. This allows security analysts to trace the progression of an attack from a clicked link to a compromised account or an endpoint breach, enabling a shift from mere detection to active disruption of the adversary's operations.
The evolving landscape of AI-driven cyber threats demands continuous vigilance and robust security measures. By understanding the tactics, techniques, and procedures employed by threat actors leveraging AI themes, organizations can better prepare their defenses. Microsoft Defender's integrated approach, from pre-delivery email protection to post-delivery incident response and cross-domain attack correlation, aims to provide comprehensive security against these increasingly sophisticated and pervasive threats.