Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity

Kaspersky researchers discovered multiple widespread campaigns using fake DeepSeek/Grok websites and social-media posts to distribute malicious installers and archives that deploy a Python-based stealer, PowerShell-based downloaders that enable SSH backdoors, DLL-sideloaded loaders, and KCP backdoors. The report details three schemes, technical indicators (MD5s and domains), distribution vectors (including an X post with 1.2M views), and recommends vigilance because victims may lose account credentials, cryptocurrency, and potentially expose corporate credentials.