logo

Free AI editor lures in victims, installs information stealer instead on Windows and Mac

ID: 78bfbe94-a268-5e61-a2c2-1d11f96aa16a

STIX ID: report--78bfbe94-a268-5e61-a2c2-1d11f96aa16a

Feed Name: Malwarebytes Blog

Threat Score
70/100

Date Published: 2024-11-19

Date Updated: 2026-04-28

...
...

A coordinated social-media campaign promoted a fake "EditProAI" video editor that delivers information-stealing malware: Lumma Stealer (Windows) and Atomic Stealer/AMOS (macOS). The campaign used many accounts across X, Facebook, and YouTube to host professional-looking pages linking to installers (e.g., Edit-ProAI-Setup-newest_release.exe and EditProAi_v.4.36.dmg); the stealers target browser credentials, extensions, cookies, cryptocurrency wallets and MFA-related artifacts, and are available via a Malware-as-a-Service model. Users are advised to monitor financial accounts, change passwords, enable MFA, and use anti-malware tools that detect these threats.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.