Image by Solen Feyissa, from Unsplash
Google Ads Used To Spread Fake DeepSeek Malware
Reading time: 2 min
Last Updated: Jun 12, 2025
-
![Kiara Fabbri]()
-
![Sarah Frazier]()
Fact-Checked by Sarah Frazier Content Manager
Cybersecurity researchers have identified a dangerous new malware campaign, which targets users of the popular AI chatbot DeepSeek-R1.
In a rush? Here are the quick facts:
- Fake DeepSeek-R1 websites are spreading malware through Google Ads.
- Victims download a malicious installer disguised as a chatbot.
- Malware installs “BrowserVenom,” which hijacks and monitors web traffic
Cybersecurity researchers at Kaspersky report that attackers are using Google Ads to promote a fake version of the site, taking advantage of the model’s popularity to trick users into downloading harmful software.
The malicious ad directs users to ‘‘deepseek-platform[.]com’’ – a fake website that mimics the official DeepSeek site. Users who click the “Try now” button are presented with a fake CAPTCHA before being asked to download what appears to be the DeepSeek installer. The file, named ‘‘AI_Launcher_1.21.exe’’, is actually a sophisticated malware chain.
The installer opens a second fake CAPTCHA, then offers to install known AI tools like Ollama and LM Studio. But in the background, it runs hidden code that begins the infection. First, it tries to bypass antivirus software by excluding the user’s folder from Windows Defender. Then, it attempts to download more malware from another untrustworthy domain.
The final payload, known as BrowserVenom, modifies browser configurations to redirect all web traffic through proxy servers operated by the attackers. This allows them to monitor user data and online activities. The malware adds a fake certificate to the system while modifying browser shortcuts and settings in Firefox and Tor.
The researchers note that he attack has already targeted users in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.
“As we have been reporting, DeepSeek has been the perfect lure for attackers to attract new victims,” researchers said. They warn users to double-check website URLs and certificates before downloading software, even from search results, to avoid falling into these traps.
Previous Story
Latest articles 
