Attackers are leveraging Microsoft’s AI-assisted Bing Chat to trick users searching for software downloads into visiting malicious sites and clicking on fraudulent ads to then install malware directly from a Bing Chat conversation.
In a blog post Sept. 28, Malwarebytes researchers explained that in the attacks involving Bing Chat, users have a choice of either visiting the real link they originally searched for, or a bogus ad inserted by a threat actor that takes the user to a fraudulent site.
The researchers said because the ads tend to get listed first in these cases involving the bogus ads, users are more apt to click on the fraudulent ad that loads the malware.
Security researchers were interested in the news from Malwarebytes because it demonstrated how threat actors could abuse AI search engines to launch their malicious activities.
“We have a few concerns with how these bad actors are using AI and chatbots, including to code malware and for more effective social engineering,” said Zane Bond, head of product at Keeper Security. “While vulnerabilities like the one described by Malwarebytes will likely get addressed as they arise, bad actors will continue to use AI chatbots for social engineering and phishing.”
Threat actors are always looking for new ways to trick people with their social engineering tactics, and that’s essentially what they’re doing here with this Bing Chat redirect attack,” said Mika Aalto, co-founder and CEO at Hoxhunt. Aalto said people tend to lower their defenses when engaging with a new platform or technology, so a redirect to a socially-engineered message crafted with false urgency can be more effective with some users on Bing Chat than on email.
“It's important that security teams focus on employee behavior, not just awareness, in our age of sophisticated online attacks,” said Aalto. “The legacy security awareness training model was designed for compliance with yesterday's threats. What’s needed for the attacks of today and tomorrow is a dynamic security behavior change platform that stays current with the constantly evolving threat landscape.”
