Chinese-speaking Hacking Group Attacking Users With Fake DeepSeek Page to Deliver Malware
Brief
Chinese-speaking cybercriminals are using fake software pages that imitate popular artificial intelligence tools to infect Windows users with remote access malware.
The campaign turns interest in DeepSeek into a trap, offering what looks like a normal download but delivering an installer built to hide its real purpose.
The operation also impersonates Quark Cloud and Pony Activator, widening the number of people who might trust the download.
Once the installer runs, it launches a chain designed to weaken security controls and give attackers a foothold that can be used for surveillance, theft, or further malware delivery.
Analysts at Zscaler ThreatLabz identified the activity and linked it to a Chinese-speaking cybercrime group.