E-Business
Kaspersky Uncovers Sophisticated Deception Campaign using DeepSeek AI as Bait
Security researchers at Kaspersky have revealed how cybercriminals used geofencing, compromised business accounts and coordinated bot networks to distribute malware disguised as DeepSeek AI software, generating over 1.2 million views on X.
Kaspersky’s Threat Research and AI Technology Research have jointly identified a sophisticated deception campaign exploiting the rapid growth and public interest surrounding DeepSeek AI — a popular generative AI chatbot — in order to distribute malware through fraudulent websites.
In their investigation, Kaspersky researchers revealed that cybercriminals established deceptive replicas of the official DeepSeek website, using domain names like “deepseek-pc-ai[.]com” and “deepseek-ai-soft[.]com.”
A distinctive feature of this campaign was its use of geofencing technology, where malicious websites examine each visitor’s IP address and dynamically alter content presentation based on geographic location, enabling attackers to fine-tune their approach and reduce detection risks.
“This campaign demonstrates notable sophistication beyond typical social engineering attacks,” explained Vasily Kolesnikov, senior malware analyst at Kaspersky Threat Research.
“Attackers exploited the current hype around generative AI technology, skillfully combining targeted geofencing, compromised business accounts and orchestrated bot amplification to reach a substantial audience while carefully evading cybersecurity defenses.”
According to Kaspersky’s analysis, the campaign’s primary distribution channel was the social media platform X. Attackers strategically compromised the social media account of a legitimate Australian company to widely disseminate fraudulent links. This single malicious post drew significant attention, reaching approximately 1.2 million impressions and generating hundreds of reposts.
Researchers determined that these reposts largely originated from coordinated bot accounts — evident due to their similar naming conventions and profile characteristics — indicating a deliberate amplification of the malicious content.
Visitors lured to the fraudulent websites were directed to download a fabricated DeepSeek client application. Instead of the authentic software, these sites delivered malicious installers using the Inno Setup installation platform.
Once executed, these compromised installers attempted to contact remote command-and-control servers to retrieve Base64-encoded PowerShell scripts. These scripts subsequently activated Windows’ built-in SSH service, reconfigured it with attacker-controlled keys and enabled full remote unauthorised access to compromised systems.
All malware payloads connected to this campaign are proactively identified and blocked by Kaspersky security products such as Trojan-Downloader.Win32.TookPS.* variants.
Transcorp Hotels Plc has delivered a stellar performance in the first half of 2025, recording a 60% year-on-year surge in revenue to ₦47.57 billion, up from ₦29.72 billion in H1 2024. Gross profit climbed 71% to ₦36.21 billion, maintaining a strong 76% margin despite inflation and operational headwinds.
The hospitality giant, a subsidiary of Transnational Corporation Plc, also announced an interim dividend payout of ₦1.024 billion — offering ₦0.10 per 50 kobo ordinary share to shareholders.
In a bold move, the company unveiled Nigeria’s largest corporate venue — the 5,000-seat Transcorp Centre — staking its claim as the new leader in event hospitality. Chairman Emmanuel Nnorom described the results as proof of Transcorp Hotels’ transformative strategies and unwavering investor commitment. MD/CEO Uzo Oshogwe attributed the success to relentless execution and a resilient business model.
Transcorp Hotels, renowned for iconic assets like Transcorp Hilton Abuja and its digital platform Aura, says it isn’t just leading Nigeria’s hospitality sector — it’s redefining excellence across Africa.
Chinese “threat actors” have hacked Microsoft’s SharePoint document software servers and targeted the data of the businesses using it, the firm has said.
China state-backed Linen Typhoon and Violet Typhoon as well as China-based Storm-2603 were said to have “exploited vulnerabilities” in on-premises SharePoint servers, the kind used by firms, but not in its cloud-based service.
The US tech giant has released security updates in response and has advised all on-premises SharePoint server customers to install them.
“Investigations into other actors also using these exploits are still ongoing,” Microsoft said in a statement.
The firm said it had “high confidence” the hackers would continue to target systems which have not installed its security updates.
It added that it would update its website blog with more information as its investigation continues.
Microsoft said it had observed attacks in which hackers had sent a request to a SharePoint server “enabling the theft of the key material by threat actors”.
Charles Carmakal, chief technology officer at Mandiant Consulting firm, a division of Google Cloud, told reporter, it was “aware of several victims in several different sectors across a number of global geographies”.
Carmakal said it appeared that governments and businesses that use SharePoint on their sites were the primary target.
A number of adversaries who stole material encoded by cryptography were then able to regain ongoing access to the victims’ SharePoint data, he said.
“This was exploited in a very broad way, very opportunistically before a patch was made available. That’s why this is significant,” Carmakal said.
Carmakal said the “China-nexus actor” was deploying techniques similar to previous campaigns associated with Beijing.
Microsoft said Linen Typhoon had “focused on stealing intellectual property, primarily targeting organizations related to government, defence, strategic planning, and human rights” for 13 years.
It added that Violet Typhoon had been “dedicated to espionage”, primarily targeting former government and military staff, non-governmental organizations, think tanks, higher education, the media, the financial sector and the health sector in the US, Europe, and East Asia.
Meanwhile, Storm-2603 was “assessed with medium confidence to be a China-based threat actor”.
National Identity Management Commission (NIMC) has issued a public warning that it is not associated with NINcard.com.
According to the commission, the website has been circulating online to offer services for Nigerians seeking National Identification Number (NIN) services.
NIMC, in a post on its official X account on Wednesday, said, “NINcard.com is not in anyway affiliated to NIMC. Stay vigilant!”
The warning was accompanied by screenshots of fake payment receipts and OTP request pages from the website, both of which were boldly stamped “FAKE” by NIMC to alert the public.
NIBBS: Banks Close 29.4m Accounts, Dormant Accounts Hit 33.39m
NDPC Hides MultiChoice Privacy Violation Details Despite FOI Request- FIJ
Cardoso, CBN Boss Risks Arrest over Alleged N5.2 Trillion Unremitted Funds
UK Businesses Look to Africa As Strategic Growth Partners
FG Plans N50m STEEM Grant to Support Student Innovation in August
E-Business1 day agoTranscorp Hotels Delivers Stellar H1 Results, Declares Over ₦1Bn Dividend
General News1 day agoFG Plans N50m STEEM Grant to Support Student Innovation in August
Telecom2 days agoAirtel Africa Grew Customer Base to 169m as Q1 Revenue Hits $1.4 Billion
Broadcasting2 days agoParadigm Initiative Applauds Malawi’s Judiciary for Outlawing Criminal Defamation
E-Financial1 day agoCardoso, CBN Boss Risks Arrest over Alleged N5.2 Trillion Unremitted Funds
General News2 days agoFintechNGR Rejigs Nigeria Fintech Week with Multi-location Model
Telecom1 day agoMTN Media Innovation Programme Fellows Gain Insight into Nigeria’s Connectivity Backbone
General News2 days agoGuinness Nigeria Sustains Growth Momentum in Q4 Amid Market Headwinds