Unmasking Ransomware: The Hidden Threat in AI and Business Tools

TL;DR

Cybercriminals are concealing ransomware within fake AI and business tools, posing a significant threat to small businesses. This article explores recent attacks, the tactics used, and provides essential steps to safeguard your business.

The Emerging Threat: Ransomware Hidden in AI and Business Tools

Artificial intelligence (AI) and small business tools are increasingly being exploited by cybercriminals to deliver ransomware. In a series of masquerade campaigns discovered by Cisco Talos, malware was hidden within software and install packages mimicking legitimate services such as Nova Leads, ChatGPT, and InVideo AI.

The Rising Adoption of AI Tools by Small Businesses

Small businesses are rapidly adopting AI tools to enhance productivity. A recent survey by the US Chamber of Commerce and Teneo revealed that 98% of small businesses use at least one AI-powered product, with 40% utilizing generative AI. This trend highlights the urgent need for cybersecurity awareness among small business owners.

The Dual Threat Identified by Cisco Talos

Researchers at Cisco Talos have identified a twofold threat:

1. Deceptive AI Solutions: Unsuspecting businesses searching for AI tools may download counterfeit software embedded with malware. This not only compromises sensitive data and financial assets but also undermines trust in legitimate AI market solutions¹.

2. SEO Poisoning: Cybercriminals are manipulating SEO practices to rank malicious websites high in search results, a tactic known as “SEO poisoning.” This method is employed by scammers and hackers to lure victims to fake websites.

Case Studies of Recent Attacks

Fake Nova Leads Website

Cybercriminals created a fake website resembling Nova Leads, a legitimate lead monetization service. The fake site offered a non-existent AI-powered product called “Nova Leads AI.” Users attempting to download this tool were infected with CyberLock ransomware, which claimed to support humanitarian causes while demanding a $50,000 ransom in cryptocurrency².

ChatGPT Installer Hiding Lucky_Gh0$t Ransomware

A software installer labeled “ChatGPT 4.0 full version – Premium.exe” was found to contain Lucky_Gh0$t ransomware. The installer included legitimate open-source AI tools from Microsoft, likely to evade antivirus detection. Unlike CyberLock, Lucky_Gh0$t made no humanitarian claims, stating bluntly, “We are not a politically motivated group and we do not need anything other than your money.”³

Numero Malware Targeting InVideo AI

A new malware, dubbed “Numero,” was discovered to render systems completely unusable. This malware co-opted the names of InVideo AI, an AI-powered video generation service. While not officially ransomware, Numero poses a significant threat to system functionality⁴.

How to Protect Your Small Business from Ransomware

Preventing a ransomware attack is crucial. Follow these steps to secure your business:

• Block Common Entry Points: Patch known vulnerabilities in internet-facing software and harden login credentials for remote work tools like RDP ports and VPNs.
• Prevent Intrusions: Use always-on cybersecurity software to stop threats early and prevent malware delivery.
• Create Offsite, Offline Backups: Keep backups offsite and offline, beyond the reach of attackers, and test them regularly.
• Avoid Repeated Attacks: After isolating an outbreak, remove all traces of the attackers, their malware, tools, and entry methods to prevent recurrence.

For more details, visit the full article.

Conclusion

The increasing use of AI tools by small businesses presents new opportunities for cybercriminals to deploy ransomware. By understanding these threats and implementing robust cybersecurity measures, small businesses can protect themselves from these evolving dangers. Stay informed and vigilant to safeguard your business in the digital age.

References

1. (June 5, 2025). “Ransomware hiding in fake AI, business tools”. Malwarebytes Blog. Retrieved June 18, 2025. ↩︎

2. (June 5, 2025). “Fake AI tool installers”. Cisco Talos. Retrieved June 18, 2025. ↩︎

3. (June 5, 2025). “Fake AI tool installers”. Cisco Talos. Retrieved June 18, 2025. ↩︎

4. (June 5, 2025). “Fake AI tool installers”. Cisco Talos. Retrieved June 18, 2025. ↩︎