AI-Themed SEO Poisoning Attacks Spread Info, Crypto Stealers

Zscaler ThreatLabz uncovered an active SEO-poisoning campaign that ranks AI-themed WordPress sites highly in search results to trick users into visiting pages that run obfuscated JavaScript (hosted via AWS CloudFront), collect browser data, and redirect victims to multi-stage payloads delivering Vidar and Lumma infostealers and Legion Loader; attackers use large, password-protected NSIS installers and AutoIT loaders to evade sandboxes and deliver credential- and crypto-stealing malware, and Zscaler provides IOCs and detection guidance.