How Threat Actors Are Rizzing Up Your AI for Profit

This report warns that criminal Traffic Distribution Systems (TDS) such as TAG-124 and operators of campaigns like SocGholish/FakeUpdates are shifting from traditional SEO poisoning to 'LLM-optimized' content poisoning—using aged-domain farms, automated high-velocity content, LLM-aware cloaking, citation networks, and slopsquatting—to manipulate retrieval-augmented generation and drive AI recommendations toward malicious downloads and scams; it documents observed infrastructure and economic incentives and recommends mitigations including link provenance verification, temporal correlation detection, sandboxing AI suggestions, source-transparency controls, and real-time URL reputation checks.