Malware attack disguises itself as DeepSeek installer

Cybercriminals are exploiting the growing interest in open source AI models by disguising malware as a legitimate installer for DeepSeek.

Victims are unwittingly downloading the “BrowserVenom” malware designed to steal stored credentials, session cookies, etc and gain access to cryptocurrency wallets.

How are the bad guys spreading the malware? By buying Google ads… sigh… which point to a fake DeepSeek download page.

Google says it has suspended the advertiser’s account. No doubt the cybercriminals won’t… oh, i don’t know… just create another account and try again, perhaps?

I think it would be better if the whole world ignored all Google ads, or.. hey.. perhaps ditched Google altogether.

Find more discussion of this issue in the comments on my LinkedIn post.

Found this article interesting? Follow Graham Cluley on Bluesky or Mastodon to read more of the exclusive content we post.