Exploiting AI How do they target trust?

• In early 2025, the Check Point Research team detected a campaign cyber attack exploiting the popularity of the Generative AI service, Kling AI. The attack began through misleading ads on social media, which led to a fake website designed to trick users into downloading malicious files.
• The attack leveraged fake pages and Facebook ads to distribute a malicious file, which ultimately triggered a Remote Access Trojan (RAT), allowing attackers to remotely control the victim's system and intercept sensitive data.
• The malware used in this campaign incorporated advanced obfuscation techniques, such as file masquerading to disguise malicious executable files as innocent media, as well as extensive anti-analysis methods to avoid detection.
• The solutions Threat Emulation and Harmony Endpoint Check Point's products offer strong protection against the techniques and threats described in this campaign, ensuring defense against malicious files, remote access tools, and targeted attacks through social engineering.

As the generative AI continues to attract global attention, cybercriminals are rushing to exploit the technology’s potential and popularity. From deepfakes to impersonation attacks, the growing reliance on AI-powered platforms has created new opportunities for threat actors.

In early 2025, Check Point Research began tracking a sophisticated threat campaign that exploited this trend, specifically impersonating Kling AI – a highly popular AI-powered image and video synthesis tool with over 6 million users.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

The campaign was spread through fake ads and fake Facebook pages, which ultimately led users to a fake website with the aim of installing malicious software ( malicious payload ). In this blog, we analyze the tactics used in the campaign and examine how attackers exploit the trustworthiness of generative AI services to mislead users and spread malware.

For a comprehensive understanding of the impersonation attack, read Check Point Research 's paper here

Stage 1: From fake ads to fake downloads

The attack begins with fake ads on social media. Since early 2025, our team has identified approximately 70 sponsored posts falsely promoting the popular artificial intelligence tool Kling AI. These ads originate from convincing but deceptive Facebook pages designed to look like the company’s official account.

Clicking on one of these ads takes the user to a fake website that closely mimics the real Kling AI user interface. Like the authentic tool, the website asks users to upload images and click the “Generate” button to see AI-powered results.

However, instead of delivering an image or video, the site offers a download – a file that appears as a compressed folder (archive file), supposedly containing a new multimedia file created via AI.

The file the user downloads appears to be a harmless image, with a name like Generated_Image_2025.jpg and even has an icon that resembles an image file. However, behind this seemingly innocent appearance lies something dangerous: it is a camouflaged program designed to compromise the user's system. This technique — known as filename masquerading — is a common tactic used by cybercriminals to trick users into running malicious software.

Once opened, the program installs silently, makes sure to start automatically every time the computer is turned on, and checks for any signs that it is being monitored or analyzed by cybersecurity tools, trying to avoid detection.

Stage 2: Silent takeover via Remote Access Tools

After the initial fake file is opened, a second and more serious threat is triggered. At this stage, a Remote Access Trojan (RAT) is installed — a type of malware that allows attackers to gain remote control over the victim's computer.

Each version of this tool is slightly modified to evade detection, but all include a hidden configuration file that communicates with the attackers’ server. These files contain campaign names such as “Kling AI 25/03/2025” or “Kling AI Test Startup,” suggesting that the attacks are under constant testing and development by the threat actors.

Once installed, the malware begins monitoring the system — primarily focusing on web browsers and extensions that store passwords or other sensitive data — giving attackers the ability to steal personal information and maintain long-term access.

A Familiar Scenario: The Campaign Trail

While the identity of the attackers remains unknown, evidence strongly suggests a connection to threat actors from Vietnam. Facebook scams and malware campaigns are well-known tactics used by groups in the region — particularly those targeting personal data.

In this case, our analysis revealed multiple clues in this direction. Similar AI tool-themed campaigns have previously included Vietnamese terms within the malware code. In line with this pattern, we also found several references — such as debug messages — written in Vietnamese in this campaign.

These findings align with broader trends that other cybersecurity researchers have observed, examining similar malvertising campaigns via Facebook.

Tackling the new generation of AI-centric threats

As generative AI tools continue to gain popularity, cybercriminals are finding new ways to exploit that trust. This particular campaign, which impersonated Kling AI through fake ads and deceptive websites, demonstrates how threat actors are combining social engineering techniques with advanced malware to gain access to users’ systems and personal data.

With tactics ranging from file masquerading to remote access and data theft , and with indications pointing to threat groups from Vietnam, this operation is part of a broader trend of increasingly targeted and sophisticated attacks via social media.

To help organizations stay protected, Check Point offers Threat Emulation and Harmony Endpoint solutions , which provide comprehensive coverage across different attack methods, file types, and operating systems — effectively blocking the threats described in this report.

As always, proactive threat detection and user education remain key elements in defending against evolving cyberthreats.

Read the Check Point Research publication here

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.