Threat Actors Leverages DeepSeek-R1 Popularity to Attack Users Running Windows Devices

Cybercriminals have begun exploiting the surge in popularity of DeepSeek-R1, one of the most sought-after large language models currently available, to distribute a sophisticated new malware strain targeting Windows users. The malicious campaign uses the artificial intelligence chatbot’s growing demand as a lure to trick unsuspecting users into downloading what appears to be legitimate DeepSeek […] The post Threat Actors Leverages DeepSeek-R1 Popularity to Attack Users Running Windows Devices appeared first on Cyber Security News.

Jun 12, 2025 - 19:20

Threat Actors Leverages DeepSeek-R1 Popularity to Attack Users Running Windows Devices

Cybercriminals have begun exploiting the surge in popularity of DeepSeek-R1, one of the most sought-after large language models currently available, to distribute a sophisticated new malware strain targeting Windows users.

The malicious campaign uses the artificial intelligence chatbot’s growing demand as a lure to trick unsuspecting users into downloading what appears to be legitimate DeepSeek software but instead delivers a dangerous payload designed to compromise their browsing activities.

The attack begins with a carefully orchestrated malvertising campaign that places fraudulent websites at the top of Google search results when users search for “deepseek r1”.

The primary phishing site, deepseek-platform[.]com, masquerades as the official DeepSeek homepage and employs sophisticated detection mechanisms to identify Windows users before presenting them with a singular “Try now” button that initiates the infection chain.

Malicious website mimicking DeepSeek (Source – Securelist)

This approach demonstrates the threat actors’ understanding of user behavior and their ability to monetize trending technology through deceptive tactics.

Securelist analysts identified this campaign as distributing a previously unknown malware variant dubbed “BrowserVenom,” which represents a significant evolution in browser-targeting malware.

The researchers discovered evidence suggesting Russian-speaking threat actors are behind the operation, with Russian-language comments found embedded within the malicious website’s source code.

The geographic distribution of infections spans multiple continents, with confirmed cases detected in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt, indicating a global reach that capitalizes on DeepSeek’s international popularity.

The malware’s impact extends beyond traditional data theft, as BrowserVenom specifically targets users’ browsing infrastructure to establish persistent network monitoring capabilities.

Once installed, the malware reconfigures all browser instances to route traffic through an attacker-controlled proxy server located at 141.105.130[.]106:37121, enabling cybercriminals to intercept, monitor, and manipulate all network communications.

Infection Mechanism and Technical Implementation

The infection process demonstrates remarkable sophistication through its multi-stage deployment and social engineering components.

After users click the initial “Try now” button, they encounter a fake CAPTCHA screen powered by obfuscated JavaScript designed to verify human interaction while avoiding automated security analysis.

Upon successful CAPTCHA completion, victims download AI_Launcher_1.21.exe, which presents another deceptive Cloudflare-style CAPTCHA before offering installation options for legitimate AI frameworks like Ollama and LM Studio.

The malware’s core functionality executes through the MLInstaller.Runner.Run() function, which operates concurrently with legitimate software installation to avoid detection.

This function first attempts to exclude the user’s directory from Windows Defender protection using a hardcoded PowerShell command that requires administrator privileges to succeed.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access

The post Threat Actors Leverages DeepSeek-R1 Popularity to Attack Users Running Windows Devices appeared first on Cyber Security News.