Cybercriminals are using SEO to get popular fake AI tools loaded with malware to rank high on Google

• Fake AI tools climb search rankings to spread ransomware and malware
• Cybercriminals are targeting tech marketing and B2B users with cloned installers
• Talos has uncovered threats that are using branding tricks and search manipulation tactics

Cybercriminals are already using AI to make phishing emails more convincing, and now they’re manipulating search engine results to spread malware disguised as AI tools.

New research from Cisco Talos claims these fake downloads appear to be legitimate software, often promoted through search engines and social platforms, and are predominantly targeting users in the tech, marketing, and B2B sales industries.

Talos recently uncovered several threats distributed this way, including ransomware families CyberLock and Lucky_Gh0$t, as well as a destructive new malware called Numero.

SEO manipulation

Talos says these threats use familiar branding, fake websites, and misleading metadata to trick users into downloading and running infected software.

In one case, attackers ...