US AI Experts Targeted in SugarGh0st RAT Campaign

Proofpoint and Cisco Talos observed a highly targeted espionage campaign (UNK_SweetSpecter) leveraging a customized Gh0st RAT variant called SugarGh0st to steal generative-AI-related information from fewer than ten US AI experts; the attack used AI-themed phishing with a zipped shortcut that deployed a JavaScript dropper, ActiveX sideloading, and an encrypted payload that ultimately connected to attacker-controlled C2 infrastructure.