{"id":25475,"date":"2024-11-19T07:10:07","date_gmt":"2024-11-19T15:10:07","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2024\/11\/19\/news-19205\/"},"modified":"2024-11-19T07:10:07","modified_gmt":"2024-11-19T15:10:07","slug":"news-19205","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2024\/11\/19\/news-19205\/","title":{"rendered":"Free AI editor lures in victims, installs information stealer instead on Windows and Mac"},"content":{"rendered":"\n<p>A large social media campaign was launched to promote a free Artificial Intelligence (AI) video editor. If the &#8220;free&#8221; part of that campaign sounds too good to be true, then that&#8217;s because it was.<\/p>\n<p>Instead of the video editor, users got information stealing malware. Lumma Stealer was installed on Windows machines and Atomic Stealer (AMOS) on Macs.<\/p>\n<p>The campaign to promote the AI video editor was active on several social media platforms, like X, Facebook, and YouTube&#8230;<\/p>\n<figure class=\"wp-block-image aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"420\" height=\"271\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/Facebook_campaign.png\" alt=\"Facebook post promising AI Video Magic in EditProAI\" class=\"wp-image-122045\" \/><\/figure>\n<p>&#8230;and had been active for quite a while. as you can see from this tweet.<\/p>\n<figure class=\"wp-block-image aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"606\" height=\"871\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/X_campaign.png\" alt=\"Tweet by EditProAi dated September 4\" class=\"wp-image-122046\" \/><\/figure>\n<p>The criminals seem to have used a lot of accounts to promote their \u201cproduct\u201d as you can see from this search on X.<\/p>\n<figure class=\"wp-block-image aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"252\" height=\"401\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/X_accounts.png\" alt=\"List of X accounts all promoting EditProAI\" class=\"wp-image-122047\" \/><\/figure>\n<p>Some accounts were expressly created for this purpose, while others look like they may have been compromised accounts.<\/p>\n<figure class=\"wp-block-image aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"552\" height=\"693\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/YouTube_campaign.png\" alt=\"YouTube video promoting EditProAI\" class=\"wp-image-122048\" \/><\/figure>\n<p>The campaign looks well organized, and looks so legitimate that it took quite a while before a researcher found out and tweeted about the threat.<\/p>\n<figure class=\"wp-block-image aligncenter size-full\"><a href=\"https:\/\/x.com\/g0njxa\/status\/1857485682299519034\"><img decoding=\"async\" loading=\"lazy\" width=\"739\" height=\"402\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/gonjxa_tweet.png\" alt=\"Warning Tweet by g0njxa\" class=\"wp-image-122049\" \/><\/a><\/figure>\n<p>When interested individuals follow the links, they\u2019ll end up on a professional looking website\u2014exactly what you would expect.<\/p>\n<figure class=\"wp-block-image aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"831\" height=\"575\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/website.png\" alt=\"EditProAI website\" class=\"wp-image-122050\" \/><\/figure>\n<p>But if they click the \u201cGET NOW\u201d button, they&#8217;ll download the information stealer and infect their device. The file is called &#8220;Edit-ProAI-Setup-newest_release.exe&#8221; for Windows, and &#8220;EditProAi_v.4.36.dmg&#8221; for macOS.<\/p>\n<p>Lumma is available through a Malware-as-a-Service (MaaS) model, where cybercriminals pay other cybercriminals for access to malicious software and its related infrastructure. Lumma steals information from cryptocurrency wallets and browser extensions, as well as two-factor authentication details. Lumma is often distributed via email campaigns, but nothing stops the cybercriminals from spreading it as a download for an AI editor, as they did here.<\/p>\n<p>AMOS makes money for its operators by finding and stealing valuable information on the computers it infects, such as credit card details, authentication cookies, passwords and cryptocurrency. Besides stealing data from the web browsers themselves, AMOS can also steal data from browser extensions (plugins).<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-what-if-you-installed-one-of-these\">What if you installed one of these?<\/h2>\n<p>Both stealers are after login credentials and financial information, so there are a few things you\u2019ll need to do.<\/p>\n<ul>\n<li>Monitor your accounts. Banking and cryptocurrency information is a prime target for these information stealers, so check your accounts and monitor them closely.<\/li>\n<li>Change all your passwords starting with the important ones, and if you\u2019re not using a password manager already, now might be a good time to get one. It can help you create and store strong passwords.<\/li>\n<li>Enable <a href=\"https:\/\/www.malwarebytes.com\/glossary\/multi-factor-authentication-mfa\">multi-factor-authentication (MFA)<\/a> on all your important accounts.<\/li>\n<li>Log out of all your important accounts on infected devices. These information stealers are capable of <a href=\"https:\/\/www.malwarebytes.com\/blog\/news\/2024\/11\/warning-hackers-could-take-over-your-email-account-by-stealing-cookies-even-if-you-have-mfa\">taking over some accounts by stealing cookies<\/a>, even if you have MFA enabled.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.malwarebytes.com\/solutions\/free-antivirus\">Malwarebytes for Windows<\/a> and <a href=\"https:\/\/www.malwarebytes.com\/mac\">Malwarebytes for Mac<\/a> can detect the information stealers, and they block the EditProAI websites.<\/p>\n<p><a href=\"https:\/\/www.malwarebytes.com\/blog\/news\/2024\/11\/free-ai-editor-lures-in-victims-installs-information-stealer-instead-on-windows-and-mac\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p> A widespread social media campaign for EditProAI turns out to spread information stealers for both Windows and MacOS users. <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[30076,2211,30077,32149,19076,30925,32,10438],"class_list":["post-25475","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-amos","tag-apple","tag-atomic-stealer","tag-editproai","tag-information-stealers","tag-lumma","tag-news","tag-threats"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/25475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=25475"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/25475\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=25475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=25475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=25475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}