A little help from your search engine. [Research Saturday]

The podcast discusses a highly sophisticated cyber attack campaign that successfully bypassed multiple security layers, demonstrating the evolving sophistication of cyber threats. The attack employed techniques such as polyglot files (MP3/HTA), in-memory execution, and PowerShell obfuscation, enabling it to evade traditional anti-malware defenses like AMSI and sandbox analysis. The attack was designed to be highly resilient by creating a large, encrypted, and obfuscated file, making reverse engineering difficult. The campaign's complexity and stealth highlight the need for advanced detection and threat hunting strategies to combat modern cyber threats.

The research details a six-stage, largely fileless attack chain targeting AI enthusiasts and small businesses seeking to install AI tools like Anthropic or Cloud Code. Attackers used SEO poisoning to rank fake install pages high in search results, tricking users into downloading malware disguised as legitimate AI software. The malware included a polyglot MP3/HTA file, which launched a malicious PowerShell script to disable security defenses and conduct in-memory operations, avoiding disk-based detection. Attackers also used unique, per-victim infrastructure, such as customized URLs and large, obfuscated scripts running in memory, to evade detection and analysis.

While the precise threat actor behind the campaign remains unattributed, the attack is presumed to originate from Russian cybercriminal groups targeting credential theft via info stealers. Their goal is monetization—stealing passwords and credentials for banking, cryptocurrency, and corporate accounts. The campaign combines social engineering, SEO tactics, and technical sophistication to maximize victim impact, illustrating a trend of blending social and technical methods to evade defenses.

Experts recommend focusing on human-aware security awareness, including vigilant URL verification, education about malicious download tactics, and awareness of suspicious network activity (e.g., unexpected HTTPS connections from MSHTA). They emphasize the importance of organizational tools such as trusted corporate AI subscriptions and strict control over authorized software to prevent installations of malicious AI tools. Threat hunting should involve monitoring specific indicators like unusual PowerShell processes, outbound connections to known malicious URLs, and irregular DNS queries.