How do criminals use Facebook to steal user data by offering AI services?

Security researchers from Bitdefender have found that hackers are using compromised Facebook accounts to steal user data. They disguise the profiles as official pages of popular AI services and run phishing ads from them.

Initially, hackers hijack popular Facebook accounts and configure them to resemble profiles of neural networks such as Midjourney, Sora, and DALL-E. These accounts are then filled with content and used to launch advertising campaigns on the social network.

In the ads, users are promised access to experimental features, but they are required to install additional software on their devices to do so. At this point, users are presented with links to download malicious programs, including Rilide, Vidar, IceRAT, and Nova, which steal user data.

Researchers note that the entire installation process was designed to make users feel threatened and concerned. For example, links from the advertising banners led to Google Drive or Dropbox. Additionally, the profiles were not verified. Despite this, hackers managed to deceive many users. The most popular fake account, which was blocked by Facebook moderators, had 1.2 million followers.