https://www.bleepingcomputer.com/news/security/bing-chat-responses-infiltrated-by-ads-pushing-malware/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Modern GPUs vulnerable to new GPU.zip side-channel attack Modern GPUs vulnerable to new GPU.zip side-channel attack + US and Japan warn of Chinese hackers backdooring Cisco routers US and Japan warn of Chinese hackers backdooring Cisco routers + Fake Bitwarden sites push new ZenRAT password-stealing malware Fake Bitwarden sites push new ZenRAT password-stealing malware + Building automation giant Johnson Controls hit by ransomware attack Building automation giant Johnson Controls hit by ransomware attack + Progress warns of maximum severity WS_FTP Server vulnerability Progress warns of maximum severity WS_FTP Server vulnerability + Microsoft breach led to theft of 60,000 US State Dept emails Microsoft breach led to theft of 60,000 US State Dept emails + Bing Chat responses infiltrated by ads pushing malware Bing Chat responses infiltrated by ads pushing malware + Get up to speed on Python with $74 off a Python bootcamp bundle Get up to speed on Python with $74 off a Python bootcamp bundle * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * Bing Chat responses infiltrated by ads pushing malware * * Bing Chat responses infiltrated by ads pushing malware By Bill Toulas * September 28, 2023 * 02:35 PM * 4 Bing Chat Malicious advertisements are now being injected into Microsoft's AI-powered Bing Chat responses, promoting fake download sites that distribute malware. Bing Chat, powered by OpenAI's GPT-4 engine, was introduced by Microsoft in February 2023 to challenge Google's dominance in the search industry. By offering users an interactive chat-based experience instead of the traditional search query and result format, Bing Chat aimed to make online searches more intuitive and user-friendly. In March, Microsoft began injecting ads into Bing Chat conversations to generate revenue from this new platform. However, incorporating ads into Bing Chat has opened the door to threat actors, who increasingly take out search advertisements to distribute malware. Furthermore, conversing with AI-powered chat tools can instill unwarranted trust, potentially convincing users to click on ads, which isn't the case when skimming through impersonal search results. This conversation-like interaction can imbue AI-provided URLs with a misplaced sense of authority and trustworthiness, so the existing problem of malvertizing in search platforms is amplified by the introduction of AI assistants. The fact that these ads are labeled as promoted results when the user hovers over a link in Bing Chat conversations is likely too weak of a measure to mitigate the risk. Imitating a popular IP scanner Malicious ads spotted by Malwarebytes are pretending to be download sites for the popular 'Advanced IP Scanner' utility, which has been previously used by RomCom RAT and Somnia ransomware operators. The researchers found that when you asked Bing Chat how to download Advanced IP Scanner, it would display a link to download it in the chat. However, when you hover over an underlined link in a chat, Bing Chat may show an advertisement first, followed by the legitimate download link. In this case, the sponsored link was a malvertisements pushing malware. The risky URL served in a Bing Chat conversationThe risky URL served in a Bing Chat conversation Source: Malwarebytes The malvertizing campaign was created by someone who hacked into the ad account of a legitimate Australian business to create two malicious ads targeting system admins (IP scanner) and lawyers (MyCase law manager). Malicious ads created by the threat actorMalicious ads created by the threat actor Source: Malwarebytes Clicking on the malicious ad for the IP scanner takes users to a website ('mynetfoldersip[.]cfd') that separates bots and crawlers from human victims by checking IP address, timezone, and various system indicators for sandbox/virtual machines. The victims are then redirected to 'advenced-ip-scanner[.]com', a clone of Advanced IP Scanner that uses typosquatting (notice the e in advenced) to trick visitors. The redirect chainThe redirect chain (Malwarebytes) The downloaded MSI installer contains three files, one of which is a heavily obfuscated malicious script that connects to an external resource to retrieve the payload. Malicious VBS in the downloaded MSIMalicious VBS in the downloaded MSI (Malwarebytes) Unfortunately, Malwarebytes could not find the final payload for this malware campaign, so it is unclear what malware is ultimately being installed. However, in similar campaigns, threat actors commonly distribute information-stealing malware or remote access trojans that allow them to breach other accounts or corporate networks. The display of malvertising within Bing Chat conversations highlights the expanding frontier of cyber threats and makes it crucial for users to be wary of chatbot results and always double-check URLs before downloading anything. Related Articles: Microsoft Teams phishing attack pushes DarkGate malware Almost 60% Of Malicious Ads Come from Three Ad Providers Malvertising Campaign Abused Chrome to Hijack 500 Million iOS User Sessions eGobbler Malvertiser Uses WebKit Exploit to Infect Over 1 Billion Ads Malvertisers exploited browser zero-day to redirect users to scams * AI * Bing Chat * Malvertising * Malware * Microsoft * Scanner * Search * * * * * Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. * Previous Article * Next Article Comments * ThomasMann Photo ThomasMann - 4 hours ago + + "...Microsoft's AI-powered Bing Chat responses, ..." Of course, what did you think AI will be used for? For YOUR advantage??? The more of all these idiotic digital toys you use, the more retarded you end up. And the less you will reamain aware enough to notice it.... * Dominique1 Photo Dominique1 - 3 hours ago + + Google ads are dangerous! Microsoft ads are dangerous! I don't need an AI to tell me that GAFAM ads are dangerous. It should be pretty clear by now. Besides! Who click these ads anyway? LOL!!! * mikebutash Photo mikebutash - 2 hours ago + + Microsoft's lack of foresight linked to rampant malware distribution, say it isn't so. * No1gr8 Photo No1gr8 - 1 hour ago + + MS had to invest $10 billion to get these ads :) What's the ROI on that? Maybe those infected will see Windows Defender ads, too. Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] [blink-ai-copilot] Popular Stories * Johnson Controls Building automation giant Johnson Controls hit by ransomware attack * Google Google assigns new maximum rated CVE to libwebp bug exploited in attacks Latest Downloads * Malwarebytes Anti-Malware Logo Malwarebytes Anti-Malware Version: 4.6.3.282 5M+ Downloads * Windows Repair (All In One) Logo Windows Repair (All In One) Version: 4.14.1 2M+ Downloads * McAfee Consumer Products Removal tool Logo McAfee Consumer Products Removal tool Version: NA 437,382 Downloads * AdwCleaner Logo AdwCleaner Version: 8.4.0.0 56M+ Downloads * Everything Desktop Search Logo Everything Desktop Search Version: 1.4.1.1017 23,896 Downloads Follow us: * * * * * Main Sections * News * VPN Buyer Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2023 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT