EvilAI Malware Impersonating AI Tools to Target Manufacturing & Retail and Hospitality Organizations

Summary

A highly capable threat campaign, codenamed EvilAI by Trend Micro, is using seemingly legitimate, digitally signed AI-enhanced productivity software, such as PDF editors, to secretly deliver various malware strains globally. These applications, which appear functional, serve as initial access conduits to perform reconnaissance, exfiltrate browser data, and prepare systems for secondary payloads. The campaign has a wide geographic spread, affecting sectors including manufacturing and retail sectors across regions, including the Americas and EMEA.

Analysis

The EvilAI campaign represents a significant evolution in malware delivery, characterized by the use of valid digital signatures from disposable companies and professional-looking interfaces to bypass security defenses and exploit user trust. The malware, acting as a stager, gains initial access and establishes persistence, taking steps to enumerate installed security software before deploying additional payloads. Further analysis has identified distinct but related malware clusters within EvilAI, such as BaoLoader and TamperedChef, which utilizes shared infrastructure and common core components but are managed by different developers with varying objectives, including advertising fraud. New variants have been observed utilizing the NeutralinoJS desktop framework to execute JavaScript payloads and interact with native system APIs, allowing for covert file system access and data siphoning via sophisticated techniques like Unicode homoglyph encoding.

The end goal of the campaign is to conduct extensive reconnaissance, exfiltrate sensitive browser data, and maintain encrypted, real-time communication with its command-and-control (C2) servers using AES-encrypted channels to receive attacker commands and deploy additional payloads.

Indicators of Compromise

Trend Micro has provided Indicators of Compromise associated with EvilAI, which can be accessed here and found below.