Hackers exploit AI interest in malware scam, Google files lawsuit

Google has initiated a lawsuit against unidentified individuals in India and Vietnam, alleging a scam that exploits the growing interest in artificial-intelligence tools. According to The Wall Street Journal, the scam specifically targets U.S. small businesses, tricking them into compromising their social-media-account passwords.

The Bard AI chatbot scam

The fraud involves deceiving small-business owners into clicking Facebook ads promising a download of Google’s Bard artificial-intelligence chatbot. However, these ads are misleading: Bard is a web-based platform and is not available for download. Hackers using bogus names like Google AI and AIGoogle Bard FB operate an organized scheme with ads falsely claiming affiliation with Google.

When victims click the offer to download Bard, malware infects their devices and steals their social-media credentials. The hackers then hijack these social-media accounts to disseminate more malware-linked ads. Google’s lawsuit, filed in a federal district court in Northern California, seeks to stop the scam and obtain damages. According to Google’s general counsel, Halimah DeLaine Prado, this may be the first lawsuit of its kind aimed at protecting users of a major tech company’s AI product.

While the full impact of this scam is still unclear, Google has reportedly filed about 300 takedown requests to remove these deceptive ads. While Facebook and other platforms have been generally responsive to these requests, the threat persists.

This scheme is indicative of a broader trend of malware scams targeting businesses, as noted by Facebook’s parent company, Meta Platforms. In May, Meta blocked 1,000+ malicious URLs offering ChatGPT-based tools, many originating from Vietnam, from being shared on its platforms.

Protecting users in the AI era

The lawsuit underscores the challenges and risks as interest in AI tools surges, particularly for small businesses on social media. It also highlights the need for heightened vigilance and robust protective measures against such sophisticated cyber scams.