E-Business
Kaspersky Uncovers Sophisticated Deception Campaign using DeepSeek AI as Bait
Security researchers at Kaspersky have revealed how cybercriminals used geofencing, compromised business accounts and coordinated bot networks to distribute malware disguised as DeepSeek AI software, generating over 1.2 million views on X.
Kaspersky’s Threat Research and AI Technology Research have jointly identified a sophisticated deception campaign exploiting the rapid growth and public interest surrounding DeepSeek AI — a popular generative AI chatbot — in order to distribute malware through fraudulent websites.
In their investigation, Kaspersky researchers revealed that cybercriminals established deceptive replicas of the official DeepSeek website, using domain names like “deepseek-pc-ai[.]com” and “deepseek-ai-soft[.]com.”
A distinctive feature of this campaign was its use of geofencing technology, where malicious websites examine each visitor’s IP address and dynamically alter content presentation based on geographic location, enabling attackers to fine-tune their approach and reduce detection risks.
“This campaign demonstrates notable sophistication beyond typical social engineering attacks,” explained Vasily Kolesnikov, senior malware analyst at Kaspersky Threat Research.
“Attackers exploited the current hype around generative AI technology, skillfully combining targeted geofencing, compromised business accounts and orchestrated bot amplification to reach a substantial audience while carefully evading cybersecurity defenses.”
According to Kaspersky’s analysis, the campaign’s primary distribution channel was the social media platform X. Attackers strategically compromised the social media account of a legitimate Australian company to widely disseminate fraudulent links. This single malicious post drew significant attention, reaching approximately 1.2 million impressions and generating hundreds of reposts.
Researchers determined that these reposts largely originated from coordinated bot accounts — evident due to their similar naming conventions and profile characteristics — indicating a deliberate amplification of the malicious content.
Visitors lured to the fraudulent websites were directed to download a fabricated DeepSeek client application. Instead of the authentic software, these sites delivered malicious installers using the Inno Setup installation platform.
Once executed, these compromised installers attempted to contact remote command-and-control servers to retrieve Base64-encoded PowerShell scripts. These scripts subsequently activated Windows’ built-in SSH service, reconfigured it with attacker-controlled keys and enabled full remote unauthorised access to compromised systems.
All malware payloads connected to this campaign are proactively identified and blocked by Kaspersky security products such as Trojan-Downloader.Win32.TookPS.* variants.
Employees may also use corporate emails to register for personal accounts on marketplaces and social media, increasing the risk of account theft and corporate security breaches, according to a study by Kaspersky Digital Footprint Intelligence.
Kaspersky shares these findings and suggests key cybersecurity practices to mitigate the risks of credential leaks.
Kaspersky experts analysed compromised credentials leaked on the dark web between 2019 and 2024 for three popular entertainment platforms: Roblox, Discord and Netflix. The analysis revealed that, on average, 7% of users whose accounts were leaked had registered on these platforms using a corporate email address.
“Registering on various services for personal use with a work email is not best practice. First, you may lose access to these accounts if you change jobs. Second, it can pose security risks for both you and your company.
“If your passwords follow a predictable pattern across different services – for example, ‘Word2025!’, where ‘2025’ is a recurring part – it increases the likelihood of other accounts being compromised, including your work account, should your corporate email be exposed in a dark web leak,” explains Sergey Shcherbel, expert at Kaspersky Digital Footprint Intelligence.
Kaspersky experts also found that bank employees most commonly registered their work email addresses on streaming services, marketplaces and social networks. In a few cases, corporate emails were also used as logins on gaming platforms and adult content websites.
Corporate email usage on entertainment platforms: statistics from a sample of 50 banking sector companies.
To conduct this study, experts compiled a sample of 50 banking sector companies and examined compromised credentials leaked on the dark web, identifying those linked to the corporate domains of these companies across five categories of popular platforms.
Learn more in the report. In light of this growing infostealer threat, Kaspersky has launched a dedicated landing page to raise awareness of the issue and provide strategies for mitigating associated risks.
If you encounter a data leak through infostealers, the following steps should be taken immediately:
- Change compromised account passwords and monitor for suspicious activity associated with those accounts.
- Run full security scans on all devices, removing any detected malware.
- Companies are recommended to monitor dark web markets proactively to detect compromised accounts before they pose risks to customers or employees. A detailed guide on setting up monitoring can be found here. Leverage Kaspersky Digital Footprint Intelligence to track what cybercriminals know about your company’s assets, identify potential attack vectors, and implement protective measures in a timely manner.
- As an enterprise, implement a security awareness program for employees, including regular training and performance assessments. Enforce a strict password policy for all corporate resources to reduce the risks of encountering credential-related cyber threats.
Nigeria Data Protection Commission (NDPC) has signed a Memorandum of Understanding with Mastercard to enhance data protection in Nigeria.
Dr. Vincent Olatunji, commissioner, NDPC and Derek Ho,deputy chief privacy officer, Mastercard
The agreement was sealed during a workshop where 150 Data Protection Officers (DPOs) were trained on Data Protection Impact Assessments (DPIAs).
Dr. Vincent Olatunji, commissioner, NDPC, said the event kicks off activities for the 8th NADPA conference, highlighting government efforts to train more certified DPOs.
Olatunji also disclosed the Federal Government’s commitment to increasing the number of certified DPOs with the required skills to manage data protection.
He noted that Nigeria’s digital-savvy youth are key to driving this agenda.
“Human capital is really key to us, and the ecosystem we are regulating is very special. It is still new, still emerging, and we need all we can to build the capacity of officers.
“We want to build the capacity of our people so we can be able to deliver on our mandate and fully deepen privacy in Nigeria.
“We are targeting to build the capacity of 250,000 DPOs annually, and we are working with partners like Mastercard to achieve that,” he said.
Derek Ho,deputy chief privacy officer, Mastercard, also stressed the need for collaboration to build trust in the digital economy and urged participants to embrace training as data protection keeps evolving.
Central Securities Clearing System PLC (CSCS) has announced the launch of *7270#, its Unstructured Supplementary Service Data (USSD) code service, set to go live on May 8th, 2025.
The USSD code service is an innovative solution designed to enhance the ease and accessibility of investment services for all users.
Also, this service leverages the network capabilities of MTN Nigeria to bring unparalleled convenience to investors.
Driven by a relentless commitment to innovation, CSCS aims to revolutionize information access within the Nigerian capital market through this USSD code service.
As the Central Securities Depository (CSD), CSCS focuses on enhancing investor experiences and providing deeper market insights with unparalleled convenience.
The CSCS USSD code service offers seamless access to essential market information directly from mobile phones, eliminating the need for internet connectivity or specialized trading platforms.
Investors can now effortlessly retrieve Clearing House Number (CHN), check Direct Cash Settlement (DCS) status, view stock positions, account balances, and account status confirmations.
Haruna Jalo-Waziri, managing director/chief executive officer of CSCS, said ” We are excited to launch the *7270# USSD code service, a significant step in leveraging mobile technology to democratize access to account and portfolio information.
“This service empowers every investor, regardless of their location or resources, to stay informed about their investments. At CSCS, we believe that financial inclusivity is key to driving economic growth.
“Our partnership with MTN Nigeria on this project represents a significant leap toward a more inclusive financial landscape, leveraging the spread of the MTN network.
“This collaboration enhances the investing experience, reinforcing our shared commitment to empowering individuals with the tools they need to manage their financial futures effectively.” he added.
The CSCS USSD code service will initially be available to MTN users only. However, CSCS plans to expand this service to other networks soon.
This innovative service offers investors streamlined and secure access to critical market information at their fingertips.
Aisha Umar Mumuni, chief digital officer of MTN Nigeria, said, “This collaboration with CSCS on the *7270# USSD service underscores MTN’s commitment to harnessing the power of mobile technology to simplify complex processes for our users.
“By making critical investment information available at the touch of a button, we are helping to democratize access to the capital markets and, in the process, enhance investor engagement and market transparency,” she said.
CSCS continues to lead the way in technological advancements, reinforcing its position as a pivotal player in the Nigerian capital market ecosystem.
This initiative underscores our dedication to enhancing market efficiency and empowering investors with the tools they need for informed decision-making.
Experts Urge Adoption of Digital Tools to Strengthen Nigeria’s Compliance Culture
Afreximbank to Fund African Energy Bank with $19bn
Firm Finds Leaked Netflix, Roblox and Discord Accounts Registered on Corporate emails
How Emerging Technologies Are Reshaping Trade – NITDA DG
Naira Gains Strength, Hits N1,600/$ in Parallel Market
E-Business2 days agoExpert Urges FG to Leverage Digital Assets to Drive Diversification Goal
General News2 days agoSeamlessHR, AOPN Push Payroll Innovation for Nigeria’s Outsourcing Growth
General News2 days agoFG Faults AfDB’s Adesina on Nigeria’s GDP Per Capita Figures
News2 days agoCabals Still Fighting our Refinery – Dangote
Telecom2 days agoTelcos Plan Zero Tariff in Some Regions with Low Opex
E-Financial2 days agoFirst Asset Management Surpasses ₦1 Trillion in Assets Under Management
Telecom2 days agoAVEVA Appoints Sébastien Ory as EMEA VP Partners & Channels
News1 day agoABoICT Lecture 2025 to Focus on Governance, Standardization in Artificial Intelligence Era