The Bing AI chatbot labeled the malicious website as the official website of an IP scanner provider and recommended users to visit it, despite its involvement in the malvertising attack campaign.
In the wake of OpenAI’s ChatGPT‘s soaring success, Microsoft’s Bing AI Chatbot emerged as a challenging player in the world of artificial intelligence, boasting over 100 million active users. While this achievement underscores the growing influence of AI, it has also attracted the attention of cybercriminals seeking to exploit this massive user base.
Recent revelations indicate that Bing AI has become the latest target of malvertising attacks, raising significant concerns within the cybersecurity community.
In a blog post, Jérôme Segura, a senior security researcher at Malwarebytes Labs, shed light on the alarming exploitation of Bing AI Chatbot by malicious actors. The attackers have cleverly embedded malicious advertisements within the chatbot, representing a novel approach to malvertising.
It’s crucial to note that the advertising mechanism within Bing AI Chatbot operates similarly to conventional search results, where advertisers bid on specific keywords to have their ads displayed to users conducting related searches. However, there are noteworthy distinctions in how these ads manifest within chatbots.
The attack unveiled by Malwarebytes involved cybercriminals masquerading as the Advanced IP Scanner provider to lure users into clicking on their malicious ads. Advanced IP Scanner is a tool commonly used by network administrators, hinting at the possibility that the culprits behind this campaign may be specifically targeting IT and cybersecurity professionals, although this remains unconfirmed.
In a screenshot shared by Segura, the top ad slot prominently features a website address (mynetfoldersipcfd), claiming to be the official source for downloading Advanced IP Scanner. To make things worse for unsuspecting users, Bing AI itself promoted this malicious website as the legitimate destination.
The true intent behind mynetfoldersipcfd is to segregate genuine victims from bots, sandboxes, or security researchers. It accomplishes this by scrutinizing various factors, including users’ IP addresses, time zones, and system settings, such as web rendering preferences that identify virtual machines.
Human users are redirected to a deceptive site (advenced-ip-scannercom), mimicking the official platform. Meanwhile, other unsuspecting visitors are rerouted to a decoy page. The subsequent step involves duping users into downloading and installing a fake malicious version of Advanced IP Scanner, facilitating the theft of user data. It is crucial to emphasize that the official website for downloading Advanced IP Scanner is advanced-ip-scanner.com, not (advenced-ip-scannercom).
The difference between the two sites is the use of a and e in their addresses: advanced-ip-scanner.com and (advenced-ip-scannercom). This is a typical case of Typosquatting. Typosquatting is a type of attack that involves registering domain names that are similar to popular websites but with common misspellings.
The malvertising campaign doesn’t stop here. Segura also flagged another malicious ad served through Bing AI Chatbot, where the same threat actor replicated Mycase.com, a US-based cloud legal practice management software solution. Mycase.com is instrumental in aiding attorneys and law firms in managing cases, clients, and communications.
This incident emphasised the importance of exercising extreme caution when encountering ads within chatbots and search engines. Although malvertising attacks are not novel, their execution through an AI chatbot platform is definitely an unsettling development.
To safeguard against such threats, it is advisable to employ updated anti-malware solutions, leverage browser scanning applications or plugins, and stay vigilant by keeping software and systems up-to-date. In an era of evolving cybersecurity challenges, these precautions are essential to protect against the ever-creative tactics of cybercriminals.