Chinese hackers are luring Windows users into downloading fake software pages that mimic popular AI tools like DeepSeek and Quark Cloud. ThreatLabz at Zscaler revealed in their report shared with ZeroOwl (ZeroOwl) that a group used AI-generated portals to create convincing imitations of download pages. It also underscores the common risk: even if a page looks polished and has a familiar logo, it doesn't guarantee authenticity, especially when downloaded from ads, search results, or unexpected links.
For defenders, this campaign serves as a reminder that prevention starts before infection: verify download channels, prevent users from running unapproved installers, ensure security tools cannot be easily disabled by vulnerable components, and quickly review suspicious installations to limit harm.
The developers aim to blend in by making the file look like ordinary setup software, while preparing the system for hidden activities that are hard to detect. Following this step, attackers use a signed but vulnerable Adlice TrueSight version 2.0.2 driver to terminate more than 200 security products, according to researchers. When endpoint protection is disabled, criminals gain significantly more freedom to operate undetected, exposing personal information and business systems to potential threats.
Gh0st RAT Raises the Stakes With defenses weakened, the campaign employs a variant of Gh0st RAT, a remote access trojan that allows an attacker to control infected computers remotely.
