Huntress Labs documents campaigns that use legitimate AI services and artifacts—shared conversations, model artifacts, sponsored listings, and lures—to host malicious content, skew search results, and trick users into installing malware.
Attackers are using trusted AI properties (model artifacts, shared conversations, sponsored results) as hosting and delivery mechanisms for malicious content.
Tactics include weaponized Claude Artifacts, poisoned search/sponsored results, shared-chat lures, and ClickFix-style social-engineering that directs victims to malware.
Defenders should treat AI platforms and their public artifacts as part of the attack surface inventory and apply the same scrutiny as other externally exposed resources.
Security researchers at Huntress Labs have identified multiple campaigns that exploit legitimate AI platforms and their public artifacts to carry out malicious activity. Instead of relying solely on traditional infrastructure—phishing emails, malicious domains, or compromised servers—threat actors are placing payloads, instructions, and deceptive content inside the same AI tools people trust.
How attackers use trusted AI properties
Weaponized model artifacts: Attackers upload or publish AI artifacts (for example, model components or supplemental files attached to a model) that contain links, scripts, or content designed to lead users to malware or to execute unsafe behaviors when developers or analysts interact with them.
Shared AI conversations: Publicly shared chat logs or conversation threads can be seeded with instructions, links, or file attachments that prompt users to download tools or run commands. Because these conversations originate inside an established AI platform, they appear more legitimate to some users.
Poisoned search and sponsored results: Threat actors manipulate search listings and paid placements on AI platforms or adjacent search engines to surface malicious content ahead of safer alternatives. Users following those promoted or top-ranked results risk landing on installer pages or pages that host secondary exploits.
ClickFix-style lures and social engineering: Campaigns reuse familiar social-engineering lures—prompts that mimic support pages, quick fixes, or urgent troubleshooting steps—redirecting victims to third-party downloads or credential-harvesting pages.
AI platforms have become part of the everyday workflow for developers, security teams, and knowledge workers. That trust makes artifacts and shared content attractive distribution channels. When attackers place malicious content inside the platform itself, traditional perimeter controls and email filters may not catch the delivery vector. Analysts who assume an AI-sourced link or artifact is safe because it appears on a reputable platform may be more likely to act on it.
Expect attackers to continue adapting: as defenders shift controls, adversaries will try variations—obfuscating payloads inside benign files, chaining AI platform artifacts with traditional hosting, or abusing model-anchored trust in workflows. Organizations should include AI platforms and their public outputs in threat modeling, logging, and incident response planning.
Trusted AI platforms are becoming a deliberate part of attackers' toolkits. Viewing those platforms as part of your external attack surface and applying familiar inventory, scanning, and user awareness practices will reduce the risk that an AI-hosted artifact becomes the entry point for malware or deception.
Security teams cannot manage an AI attack surface they cannot see. Models, inference APIs, agents, experimental applications, service identities, and supporting cloud resources may appear outside the inventory used for routine security reviews. Those gaps make it harder to spot exposed endpoints, risky configurations,
As AI adoption gathers pace, so does the evolution of the infrastructure that supports it. New standards and connectors keep appearing, and the ones that catch on spread through the ecosystem within months rather than years. That speed strengthens what AI can do, but makes it very difficult for security teams to mainta
Executives who underestimate the risks of autonomous systems are leaving their organizations exposed to the fastest-growing attack vector in the enterprise.
Hackers have turned commercial AI models into working parts of a cyberattack operation. The campaign paired AI-directed tasking with familiar methods such as vulnerable public-facing servers, stolen credentials, webshells, and custom remote-access malware. The operation reached Taiwan’s Kuomintang Party History Archive
AI is making credential theft faster and easier to scale, giving attackers more opportunities to abuse valid identities. Specops explains why identity security must go beyond successful authentication by verifying that both the user and the device requesting access can be trusted. [...]
Threat actors are adapting malware not only for conventional endpoint defenses and sandboxes, but also for large language model-powered tools increasingly used to triage suspicious code. ESET researchers linked the activity to Russia-aligned threat actor UAC-0099, which used the method during an attack against an organ
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.