🤚 The Open-Palm Diagnosis
Here is a sentence that would have been science fiction in 2023 and is a Microsoft security advisory in 2026: AI chatbots are recommending malware to users who politely ask them for software suggestions.
Microsoft researchers have uncovered an ongoing cryptojacking campaign in which threat actors are using SEO poisoning and — this is the part — manipulated AI chatbot responses to distribute GPU mining malware. Users querying AI assistants for software download recommendations were “presented with links to attacker-controlled domains within generated responses.” The AI didn’t just hallucinate a citation this time. It hallucinated a supply chain attack.
The campaign targets utilities commonly installed on high-performance systems — the kind of machines with expensive GPUs that would be very useful for mining cryptocurrency. The poisoned software list reads like a hardware enthusiast’s shopping cart:
- CrystalDiskInfo
- HWMonitor
- Display Driver Uninstaller
- FurMark
- K-Lite Codec Pack
- PDFgear
Notice the pattern: every one of these is a tool that power users install on machines with exactly the kind of GPU hardware worth hijacking. The targeting is not random. It is, regrettably, very good product-market fit.
👐 The Two-Handed Infection Chain
The technical execution is distressingly competent. Malicious ZIP archives hosted on subdomains of gleeze[.]com contain legitimate utility executables bundled with malicious DLLs that auto-load when the real binary runs. It’s the classic sideloading trick, but with a modern distribution channel that includes an AI concierge service.
Once the DLL loads, it uses msiexec.exe to install ScreenConnect, a legitimate remote management tool, for persistent access. Then a binary called SimpleRunPE.exe establishes six separate persistence mechanisms across multiple Windows autostart locations by process-hollowing into Microsoft-signed utilities including InstallUtil.exe, RegAsm.exe, and MSBuild.exe. The malware is literally wearing Microsoft’s own coat and using Microsoft’s own badge to walk through the front door.
The anti-analysis suite is equally thorough: VM detection, scans for 40 known analysis tool processes, and immediate termination if it suspects it’s being watched. It’s the digital equivalent of a burglar who checks for cameras, alarms, and Ring doorbells before entering — and then installs three GPU miners (gminer, lolMiner, and SRBMiner-MULTI) and puts them all to work.
🌿 The Gentle Awakening
The SEO poisoning is bad. We’ve seen that before. But the AI chatbot vector is new, and it deserves its own moment of existential discomfort.
When a search engine shows you a malicious link, there’s at least a visual hierarchy: ads are labeled, organic results have URLs you can inspect, and most people have developed some instinct for spotting sketchy domains. When an AI assistant recommends a download link, it arrives wrapped in the warm, authoritative prose of a system that sounds like it knows what it’s talking about. There’s no URL preview. There’s no “Sponsored” label. There’s just a confident paragraph that says “you can download CrystalDiskInfo from this link” and the link goes to gleeze[.]com.
The trust transfer is the vulnerability. Users trust the AI. The AI trusts the internet. The internet is full of people who would very much like to borrow your GPU. The transitive property of trust has been weaponized, and the result is that your helpful AI assistant is now an unwitting malware distribution channel.
👑 The Gold-Leaf Market Analysis
Microsoft notes that this campaign is engineered “to maximize GPU mining yield per compromised device,” prioritizing quality targets over volume. This is not spray-and-pray ransomware. This is precision cryptojacking with a target profile: people who own expensive GPUs and install diagnostic software on them.
The broader implication is uncomfortable for every company shipping an AI assistant: your chatbot is now a social engineering attack surface. If an attacker can manipulate what the model recommends — through SEO poisoning of training data, through poisoned web crawls, through whatever dark art convinced the model that gleeze[.]com is a legitimate software repository — then every helpful recommendation is a potential threat vector.
We spent years telling users not to click suspicious links in emails. Then we told them not to click suspicious links in search results. Now we have to tell them not to trust the download links that their AI assistant personally recommended in a conversational tone with no visible source attribution. The user education curve just went vertical, and the users are already exhausted.
“The AI recommended the download. The download installed a miner. The miner used your GPU. Your GPU generated $0.03 of Monero per day. The electricity cost you $4.50. This is what economists call a ‘negative-sum game’ and what AI safety researchers call ‘Tuesday.'” — The Slap of Wisdom Cybersecurity Economics Bureau, currently asking ChatGPT where to download antivirus software and bracing for the worst