Detect and disrupt AI-themed attacks with Microsoft Defender
Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.
Microsoft Threat Intelligence observed a growing set of campaigns that abuse trust in popular AI brands: a ChatGPT-themed phishing campaign sent up to 100,000 emails in one day to steal payment card data, and a Claude-themed campaign used adversary-in-the-middle techniques to harvest credentials and access tokens. Other campaigns included malvertising for a fake AI Windows plugin delivering the Vidar stealer and fraudulent DeepSeek installers distributed via GitHub. Initial access broker Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, and Microsoft notes the AI services themselves were not compromised. Microsoft also details Defender protections such as Safe Links, Safe Attachments, and attack disruption against these multi-stage lures.
- ChatGPT-themed phishing campaign sent up to 100,000 emails daily to steal payment card data
- Claude-themed campaign used adversary-in-the-middle techniques to harvest credentials and access tokens
- Malvertising for a fake AI Windows plugin delivered the Vidar infostealer
- Fraudulent DeepSeek installers were distributed through GitHub
- IAB Storm-3075 uses AI-themed malvertising to distribute payloads for downstream actors
- ATT&CK
- T1566.002 Spearphishing LinkT1557 Adversary-in-the-MiddleT1189 Drive-by CompromiseT1204.002 Malicious File
- Vendors
- Microsoft
- Threat actors
- Storm-3075
- Malware
- Vidar
- Organizations
- Microsoft Threat Intelligence
From the original article
5 min read at microsoft.com
See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post Detect and disrupt AI-themed attacks with Microsoft Defender appeared first on Microsoft Security Blog.
By Rob Lefferts · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.