Toxic trend: Another malware threat targets DeepSeek

Kaspersky describes a malvertising campaign that impersonates the DeepSeek-R1 website to distribute a malicious Windows installer (AI_Launcher_1.21.exe). The installer runs a multi-stage infection that deploys BrowserVenom, an implant that installs a malicious root certificate, modifies Chromium/Gecko browser settings and shortcuts to route traffic through an attacker-controlled proxy (141.105.130.106:37121), and thereby intercepts and decrypts users’ browsing traffic. The chain includes AES-encrypted payloads, PowerShell commands attempting Defender exclusion, a DGA-based downloader, and in-memory execution; infections were observed across multiple countries and detections are reported as HEUR:Trojan.Win32.Generic and Trojan.Win32.SelfDel.iwcv.