Threat actors are using seemingly legitimate AI tools and software to distribute malware globally, targeting sectors like manufacturing, government, healthcare, technology, and retail. This campaign, dubbed “EvilAI” by Trend Micro, affects regions including Europe, the Americas, and the AMEA region, indicating a widespread reach. The attackers are described as highly capable, blending authentic and deceptive software to distribute malware while concealing malicious features in functional applications. Programs such as AppSuite, Epi Browser, JustAskJacky, and Tampered Chef are used to carry out malicious activities without raising suspicion. These apps appear legitimate due to professional interfaces and valid digital signatures from disposable companies. The campaign’s goal is to conduct reconnaissance, exfiltrate sensitive browser data, and maintain encrypted communication with command-and-control servers to deploy additional payloads. EvilAI acts as a stager, gaining initial access, establishing persistence, and preparing systems for further attacks, while evading detection by mimicking legitimate software. The campaign employs propagation methods like mimicking vendor portals, malicious ads, and SEO manipulation. Further analysis by cybersecurity firms reveals shared server infrastructure for distributing malware like OneStart and ManualFinder. Code-signing certificates from Panama and Malaysia are used to legitimize software. The campaign uses NeutralinoJS to execute JavaScript payloads, enabling covert file system access and data siphoning, bypassing detection.