FIN7 Hosting Honeypot Domains with Malicious AI DeepNude Generators – New Silent Push Research

Silent Push analysts report that FIN7 is actively using at least seven ‘AI DeepNude’ websites and malvertising (including “Requires Browser Extension” .MSIX lures) to distribute NetSupport RAT, infostealers (RedLine, Lumma), and loaders (D3F@ck), with multiple observed domains, IPs, C2s and sample artifacts; the campaign uses multi-stage packing/obfuscation, DLL side‑loading and Java wrappers, and leverages SEO and file-hosting redirects to scale distribution, putting corporate credentials and domain-joined networks at risk.