- Microsoft researchers observed cybercriminals adapting SEO poisoning tactics to AI platforms, tricking AI into recommending spoofed utility sites like HWMonitor and CrystalDiskInfo
- Victims who follow these AI‑suggested links download malware via DLL sideloading, which installs ScreenConnect for attacker access and can lead to cryptojacking
- Defenders should treat AI recommendations with the same caution as search results, verifying links before downloading to avoid compromise
With the advent of AI, internet search habits among most users have drastically changed, with the way cybercriminals deliver malware to their victims also changing as a result.
In the years before AI, crooks would use the “SEO poisoning” technique to trick search engines into showing malicious and fraudulent websites at the very top of search engine results pages. By leveraging the trust users had in these engines, crooks could expect the malware to be downloaded without much scrutiny.
But now, AI tools are eating away at search engines’ market share, with a new report from Microsoft finding threat actors found a way to trick AI into recommending fake and malicious links.
Dropping a cryptojacker
It’s an interesting find, since most SEO experts still haven’t cracked that code and since there is no “industry standard” on getting mentioned by the AI.
In any case, Microsoft said it observed cybercriminals creating fraudulent websites spoofing popular PC utilities such as HWMonitor, or CrystalDiskInfo. They (somehow) get the AI to mention these websites to people asking about these tools and if people believe the AI, they end up downloading malware.
The malware is loaded onto the device using the DLL sideloading technique which, in turn, installs ScreenConnect and grants the attackers direct access to the device. The miscreants would then profile the device, scan the network and, if they so decide, install a cryptojacker.
The cryptojacker then mines cryptocurrency for the attackers, earning them virtual coins as the victims are left with an unusable computer and an enormous electricity bill.
"This combination of AI-assisted delivery, software impersonation, and persistent access highlights how threat actors are adapting social engineering and monetization strategies to modern user behavior," Microsoft said.
To defend against these attacks, users should do the same things they do against SEO poisoning attacks - not trust the AI/search engine responses blindly.
