Beware: Weaponized AI Tool Installers Threaten Devices with Ransomware Infection

Cisco Talos identified a campaign where threat actors distribute malware under the guise of legitimate AI tool installers: CyberLock (PowerShell/.NET ransomware that encrypts files, appends ".cyberlock", attempts anti-forensics, and demands Monero), Lucky_Gh0$t (evolution of Yashma/Chaos that encrypts or destructs files depending on size), and Numero (destructive malware that corrupts the Windows GUI and system components). Distribution leverages fake sites impersonating AI vendors, SEO poisoning, and messaging platforms; the report details technical behaviors, ransom tactics, and recommends source verification, endpoint defenses, backups, and user awareness to mitigate the threat.