AI Tricksters Spin Up Fake DeepSeek Sites to Steal Crypto

Threat actors are impersonating the DeepSeek AI chatbot with numerous fake websites that prompt users through a fake registration and CAPTCHA flow; malicious JavaScript copies a PowerShell command to the clipboard which, if executed, downloads and runs the Vidar information stealer to exfiltrate passwords, cryptocurrency wallets, cookies, and files, while using Telegram for C2 — researchers observed multiple imposter domains and recommend strengthening security and user awareness.