Hackers Capitalize on AI Hype With Sophisticated Attacks

The report documents a surge in AI-branded social engineering campaigns where actors impersonate services like ChatGPT, Claude, and DeepSeek to phish credentials, distribute signed malware via malvertising and fake installers, and SEO-poison developer searches with fraudulent GitHub repositories; notable tactics include large-scale email campaigns (up to 100,000 messages/day), CAPTCHA-gated malicious PDFs that lead to spoofed sign-in pages, and payloads that drop the Vidar stealer. It recommends phishing-resistant MFA and continuous user education to mitigate these evolving threats.