"Attackers are now packaging malware as trusted learning content," said Diana Kelley, CISO at Noma Security.
The lure: fake AI guides and developer resources
Fortinet's FortiGuard Labs says threat actors are distributing booby‑trapped archives labeled as AI study guides and developer tools — examples include file names such as "AI‑Ready PostgreSQL 18" and a fake guide to agentic coding with Claude Code. The apparent target is people searching for AI learning material; the campaign aims to trick professionals into opening what looks like trusted educational content.
Execution chain: LNK files, hidden PDFs, PowerShell, and AutoHotkey
According to Fortinet, each archive contains a shortcut (LNK) file and two hidden documents. Opening the shortcut triggers a staged chain of scripts: each stage extracts the next payload from hidden offsets inside a PDF‑named data file, decrypts it, and executes it. The attack plants scheduled tasks disguised as Realtek audio services and simultaneously opens a clean decoy document so victims see a harmless file while PowerShell stages run silently.
Fortinet's writeup notes the campaign runs "entirely through trusted system tools to stay hidden." Two files that appear to be Realtek components are actually copies of AutoHotkey, a legitimate automation tool that the attackers repurpose as an execution engine. Because the malicious logic lives in scripts rather than compiled binaries, it is harder to fingerprint with conventional file‑based detection.
Payloads and technique: rebuilding programs, process hollowing, and beaconing
One branch of the multi‑stage attack reconstructs a hidden program from numbers embedded in a fake manifest and uses process hollowing to execute it inside a genuine .NET process. The manifest yields two .NET payloads: a modular remote access trojan Fortinet tracks as clay_Client, and AsyncRAT, which beacons to its own command‑and‑control (C2) server.
Fortinet emphasizes that the campaign targets Windows users at any organization and that the chain leverages legitimate platform capabilities — PowerShell, scheduled tasks, process injection — to maintain stealth while delivering remote‑access capabilities.
AI‑assisted development and "compositional opacity"
The analysis points to signs the malware was accelerated with generative AI: Windows function names hide behind aliases drawn from Chinese mythology, and the code contains unsanitized Chinese comments that Fortinet's analysts interpret as evidence of AI‑assisted development. Ram Varadarajan, CEO of decryption technology firm Acalvio, called the approach part of a broader trend he terms "compositional opacity" — attacks split into steps that appear harmless when observed in isolation.
John Gallagher, VP at IoT cybersecurity firm Viakoo, summarized the shift in tactics: it is "an existing attack vector, just performed more quickly and made more stealthy" with AI. Gallagher added that blocking unsanctioned scripting engines like AutoHotkey would shut the technique down.
Layered defenses Fortinet and analysts recommend
Fortinet and the analysts it quoted lay out layered, operational controls to interrupt the chain used in these campaigns:
- Block or isolate unsanctioned scripting engines such as AutoHotkey.
- Tune endpoint tools to scan memory, not just files on disk, to catch in‑memory stages and process hollowing.
- Audit scheduled tasks and watch for unusual PowerShell activity and unexpected outbound traffic.
- Aim phishing training at developers, using fake AI‑tool lures to reflect the actual bait observed.
Diana Kelley also urged teams to treat downloaded documents and training assets as part of the software supply chain and suggested giving staff a vetted internal library of AI resources rather than leaving them to trust random downloads.
What this means for security teams, enterprises, and developers
Security teams: Expect adversaries to use trusted platform tools and staged chains that hide in plain sight; teams should prioritize controls that detect script execution, in‑memory activity, and anomalous scheduled tasks.
Enterprises and procurement leaders: The campaign highlights the need to treat educational content and developer assets as supply‑chain risk. Kelley recommends maintaining a vetted internal repository of AI learning materials to reduce reliance on third‑party downloads.
Developers and end users: Those searching for AI guides and developer resources should be aware that downloads matching expected names can be weaponized; targeted phishing training for developer audiences is one of the advised mitigations.
Fortinet's FortiGuard Labs analysis paints a picture of attackers leveraging trusted content formats and legitimate tooling to compress time and evade signature‑based defenses. The core question left by the campaign is operational: can defenders force these multi‑stage chains out of memory and into observable telemetry before remote access trojans like clay_Client and AsyncRAT achieve persistence and C2 beaconing?
https://www.infosecurity-magazine.com/news/fake-ai-guides-dev-tools-spread/
