Jaromir Horejsi identified a malvertising campaign where threat actors steal social media pages to promote malicious links mimicking popular AI photo editors through paid ads on Facebook.
Once victims install fake AI image editing software, it triggers the installation of Lumma Stealer malware to steal cryptocurrency wallets, credentials, and other valuable data for dark web sale or further scams.
Recommendations include using multi-factor authentication, educating employees on phishing risks, and verifying links and messages for protection against similar attacks.
[
Collection
]
[
|
...
]