DeepSeek installer or just malware in disguise? Click around and find out

Malicious actors used paid search ads and a fake DeepSeek-R1 site (deepseek-platform.com) to distribute a fake installer (AI_Launcher_1.21.exe from r1deepseek-ai.com) that deploys BrowserVenom — malware that installs a hardcoded certificate and forces browsers to use an attacker-controlled proxy, enabling credential/cookie theft and monitoring of plaintext traffic; Kaspersky observed infections across Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.