The FIN7 gang lures victims to sites containing malware , promising deepfake tool downloads , according to a new report by Silent Push.
FIN7, a Russian group that has been linked to multiple ransomware attacks, is reportedly hosting the malicious websites on multiple domains under the name aiNude[.]ai.
These sites were designed to attract Internet users who wish to acquire deepfake “deepnude” tools to create nude images from photos they upload.
Read more: Spear-phishing campaign infects recruiters with the More_eggs backdoor
The FIN7 malware gang has created two versions of these so-called “honeypot” websites: one offering free downloads of a “Deepnude Generator” tool, and the other a free trial.
By clicking on the “free download” offer, the victim is redirected to a new domain containing a Dropbox or other source hosting malware, although the report does not specify what exactly this payload includes. Similarly, if a victim selects the “free trial,” they will be asked to upload an image.
If an image is uploaded, the user receives a message that says, “Test is ready for download. Access to scientific material for personal use only.” The link is for personal use only, do you agree?”, Silent Push explained.
See more: CeranaKeeper hackers target Southeast Asia
If the user agrees and clicks “Download,” a zip file with a malicious payload is downloaded. FIN7 uses a classic Lumma Stealer and DLL sideloading to execute.
The vendor also observed FIN7 deploying Redline Stealer and D3F@ck as a service through this campaign. It is believed that the gang is using SEO tactics to rank its AI Deepnude websites high in searches.
Read also: Fake browser updates spread WarmCookie malware
Silent Push also uncovered a second FIN7 campaign, which secretly serves the malicious NetSupport RAT via similar websites that require visitors to install a browser extension. The threats lure victims to websites that mislead well-known brands such as SAP Concur, Microsoft , and Thomson Reuters through malicious advertising.
Source: infosecurity-magazine.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
