Full Report
A new malware campaign disguised as Kling AI used fake Facebook ads and counterfeit websites to distribute an infostealer
Analysis Summary
# Tool/Technique: Infostealer delivered via Kling AI Social Engineering Campaign
## Overview
A recent cybercriminal campaign is exploiting the popularity of the AI media platform Kling AI by using fake Facebook advertisements and counterfeit websites to distribute an infostealer malware. The malware is disguised as AI-generated media files delivered via ZIP archives.
## Technical Details
- Type: Malware Campaign (Infostealer Loader)
- Platform: Windows (Implied by executable/registry indicators)
- Capabilities: Delivery of a .NET-based malware loader, evasion techniques, persistence establishment.
- First Seen: Early 2025
## MITRE ATT&CK Mapping
Based on the described actions:
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1566.002 - Spearphishing Link
- **TA0003 - Persistence**
- T1547 - Boot or Logon Autostart Execution
- T1547.001 - Registry Run Keys / Startup Folder (Implied by registry modifications)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Filename manipulation using Hangul Filler characters)
- T1497 - Virtualization/Sandbox Evasion (Checking for analysis tools/VMs)
## Functionality
### Core Capabilities
- **Delivery Mechanism:** Files delivered via ZIP archives, disguised as media files (e.g., JPG, MP4) using filename obfuscation (Hangul Filler characters).
- **Loader Deployment:** The executable launches a .NET-based malware loader.
- **Evasion:** Loader utilizes Native AOT compilation in some versions, resulting in pure machine code, making static analysis and reverse engineering more challenging.
- **Anti-Analysis:** The loader checks the environment for the presence of virtual environments or security analysis tools.
### Advanced Features
- **Native AOT Compilation:** Compiling .NET code directly to machine code to bypass detection based on intermediate language (IL) code.
- **Persistence:** Establishes persistence on the compromised system via registry modification.
## Indicators of Compromise
- File Hashes: N/A (Not provided in the summary)
- File Names: Disguised as media files (.jpg, .mp4 extensions achieved via cloaking/obfuscation).
- Registry Keys: Registry modifications used for persistence (Specific keys not detailed).
- Network Indicators: N/A (C2/Network details not provided in the summary)
- Behavioral Indicators: Execution of downloaded ZIP contents, environment checks for virtualization, establishment of persistence via registry keys, execution of .NET loader compiled with Native AOT.
## Associated Threat Actors
- Unspecified cybercriminals/threat actors attempting to capitalize on the popularity of Kling AI.
## Detection Methods
- Signature-based detection: Traditional tools may struggle due to Native AOT compilation bypassing IL signature checks.
- Behavioral detection: Monitoring for file execution from unexpected archives, environment checks for analysis tools, and registry modifications indicative of persistence establishment.
- YARA rules: Unknown.
## Mitigation Strategies
- **User Education:** Training users to be highly suspicious of unsolicited advertisements (especially on social media) promoting new software or services, even if related to trending topics like AI.
- **File Handling:** Implementing policies to restrict the execution of files downloaded from the internet, particularly executables disguised with altered file extensions or obfuscation techniques.
- **Endpoint Security:** Utilizing Endpoint Detection and Response (EDR) solutions capable of detecting environmental checks and unauthorized registry persistence modifications.
- **Application Control:** Restricting the execution of unrecognized executables.
## Related Tools/Techniques
- Social Engineering via Phishing/Spoofed Sites (T1566)
- Native AOT compiled malware loaders (A newer form of file obfuscation over traditional IL packing).
- Infostealers (General category of deployed payload).