Cybercriminals camouflaging threats as AI tool installers

Cisco Talos reports active malicious campaigns distributing malware masquerading as legitimate AI tool installers: CyberLock (PowerShell-based ransomware that encrypts many file types, sets ransom notes and wipes free space), Lucky_Gh0$t (a Yashma/Chaos ransomware variant delivered via SFX installer with destructive behavior for large files), and Numero (a window-manipulating destructive binary). The report describes distribution vectors (SEO-poisoning, fake sites, Telegram/messaging), technical analysis of malware behaviors, ransom demands and notes, detection/mitigation guidance, ClamAV and Snort detections, and links to IOCs on GitHub.