{"id":11733,"date":"2026-03-25T13:39:56","date_gmt":"2026-03-25T13:39:56","guid":{"rendered":"https:\/\/events.aavar.org\/avar2025\/?page_id=11733"},"modified":"2026-03-25T13:39:56","modified_gmt":"2026-03-25T13:39:56","slug":"unmasking-ai-themed-malvertising-targeting-social-media-users","status":"publish","type":"page","link":"https:\/\/events.aavar.org\/avar2025\/index.php\/unmasking-ai-themed-malvertising-targeting-social-media-users\/","title":{"rendered":"Unmasking AI-Themed Malvertising Targeting Social Media Users"},"content":{"rendered":"\n[vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column]\n\n\n\n
\n
\n
<\/div>\n\n\n\n

AGENDA<\/p>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n\n\n\n

[\/vc_column] [\/vc_row]<\/p>\n\n\n\n

<\/div>\n\n\n\n

<— Back<\/a><\/strong><\/p>\n\n\n\n

Unmasking AI-Themed Malvertising Targeting Social Media Users<\/p>\n\n\n\n

Social media platforms provide cybercriminals with significant opportunities to launch malicious attacks against unsuspecting users. One prevalent infection vector is malvertising, where threat actors craft compelling posts tied to trending topics, such as generative AI or major global events, and exploit ad networks to maximize their reach. These deceptive posts often include links to fraudulent domains impersonating legitimate AI tools, enticing users to download and install malicious payloads. These payloads typically contain info-stealers capable of exfiltrating sensitive personal data, such as login credentials or financial details, which can be used to gain unauthorized access or hijack victims\u2019 social media accounts.<\/p>\n\n\n\n

In this presentation, we examine the current landscape of malvertising on social media platforms and analyze the most common techniques employed by cybercriminals to deceive users. We will focus on a prolific AI-themed malvertising campaign, dissecting its entire infection chain from initial engagement to payload delivery. Examples of fake and hijacked Facebook pages, boosted malicious posts, and distributed malicious packages will be presented. We will demonstrate our approach to analyzing these often multi-layered, obfuscated packages and extracting critical artifacts, such as campaign IDs and command-and-control (C&C) servers, from the samples. <\/p>\n\n\n\n

Additionally, we will analyze several notable malware families observed in the wild, including:<\/p>\n\n\n\n

    \n
  1. Remote Access Trojans (RATs) like XWorm, PureHVNC with advanced data-stealing capabilities<\/li>\n\n\n\n
  2. Information stealers, such as Noodlophile, written in .NET or Python<\/li>\n<\/ol>\n\n\n\n

    Finally, we will share our threat-hunting techniques and discuss the primary targets of these campaigns, providing insights into mitigating such threats.<\/p>\n\n\n\n

    <\/div>\n\n\n\n
    \n
    \n
    \n
    \n
    \"\"<\/figure>\n<\/div><\/div>\n\n\n\n
    \n

    Jarom\u00edr Ho\u0159ej\u0161\u00ed – Check Point<\/strong><\/strong><\/strong><\/p>\n\n\n\n

    Jarom\u00edr Ho\u0159ej\u0161\u00ed is a Security Researcher at Check Point Research, specializing in tracking and reverse-engineering threats, including APTs, DDoS botnets, banking trojans, click fraud, and ransomware targeting Windows and Linux systems. His work has been presented at leading conferences such as RSAC, SAS, Virus Bulletin, HITB, FIRST, AVAR, Botconf, and CARO.<\/p>\n<\/div>\n<\/div>\n\n\n\n

    <\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    [vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column] AGENDA [\/vc_column] [\/vc_row] <— Back Unmasking AI-Themed Malvertising Targeting Social Media Users Social media platforms provide cybercriminals with significant opportunities to launch malicious attacks against unsuspecting users. One prevalent infection vector is malvertising, where threat actors craft compelling posts tied to trending topics, such as generative AI or major global events, and exploit ad networks<\/p>\n

    <\/div>\n

    Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-11733","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/comments?post=11733"}],"version-history":[{"count":1,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11733\/revisions"}],"predecessor-version":[{"id":11735,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11733\/revisions\/11735"}],"wp:attachment":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/media?parent=11733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}