Fake AI Video Generators Infect Devices With Info-Stealing Malware

Cybercriminals use fake AI video generator sites to spread malware, stealing user data and enabling remote access.

Cybercriminals are taking advantage of the AI boom by luring people with fake AI video tools that secretly infect devices with malware. According to cybersecurity experts at Mandiant, a hacker group known as UNC6032 has been running a large-scale campaign since mid-2024 using bogus “AI video generator” websites.

The trick starts with ads on platforms like Facebook and LinkedIn, disguised as well-known tools like Luma AI or Canva Dream Lab. These ads link to fake sites that claim to turn text into videos. But instead of creating content, these sites serve malware, regardless of what the user inputs.

“These fake ‘AI video generator’ websites distribute malware leading to the deployment of payloads such as Python-based infostealers and several backdoors,” explained researchers Diana Ion, Rommel Joven, and Yash Gupta from Mandiant.

Victims download a file that appears to be a video but is actually a disguised program (with hidden file extensions) that installs malware.

One such malicious file, called STARKVEIL, drops three types of malware focused on stealing login details, credit card data, browser extensions, and more. It also enables hackers to remotely control infected systems using tools like XWORM, FROSTRIFT, and GRIMPULL.

Mandiant said these attacks have already reached millions through thousands of fake ads, mostly on Facebook. Meta has worked to take down many of the malicious ads and accounts involved. Most of the websites involved in this scam have similar layouts and pretend to offer AI-based video generation.

The malware communicates with the hackers through platforms like Telegram and uses insidious techniques to avoid being detected by antivirus software or cybersecurity tools.