Cybercriminals camouflaging threats as AI tool installers
Summary: Cisco Talos reported that threat actors are distributing malware disguised as AI tool installers through SEO-poisoning tactics and platforms such as Telegram and social media messengers, targeting businesses in B2B sales, technology and marketing. Talos uncovered the CyberLock and Lucky_Gh0$t ransomware families and a new destructive malware called Numero, including a fake site at 'novaleadsai[.]com' impersonating 'novaleads.app' that delivered a .NET loader compiled on Feb. 2, 2025, the same day the fake domain was created.
Bottom line: CyberLock demands a USD $50,000 ransom in Monero split across two wallets and threatens to expose stolen data within three days, while Numero overwrites desktop window titles and contents with the string '1234567890' until the machine is unusable - and Talos found no evidence of data exfiltration in the CyberLock code, meaning the intimidation is the leverage.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026