Microsoft warns AI chatbots used in cryptojacking campaign

Microsoft has warned that cybercriminals are actively using manipulated AI chatbot recommendations to direct users to malicious websites in a targeted cryptojacking campaign. The campaign impersonates legitimate system utility software to compromise computers with high-performance graphics processing units (GPUs), which are valuable for cryptocurrency mining.

Researchers observed that attackers are adapting traditional search engine optimization (SEO) poisoning tactics to influence AI platforms. When users query AI chatbots for software download recommendations, the systems can be tricked into recommending links to attacker-controlled websites that spoof popular tools like HWMonitor, CrystalDiskInfo, Display Driver Uninstaller, FurMark, KLite Codec Pack, and PDFgear. This method represents an extension of social engineering beyond conventional search results.

The selection of these software brands is deliberate, as they are commonly used by PC enthusiasts and hardware-focused users who are likely to own systems with powerful GPUs. The threat actor appears focused on compromising systems with higher mining potential rather than infecting a large volume of devices.