TRJ CYBERSECURITY INTEL REPORT
Category: Malvertising / Infostealer Campaign
Features: Fake AI video generators, social media malvertising, credential theft, STARKVEIL malware deployment, Telegram API exfiltration
Delivery Method: Fraudulent ad networks via Facebook, LinkedIn, and compromised accounts; malicious file drops through spoofed AI generator websites
Threat Actor: UNC6032 — Vietnam-based threat group leveraging AI interest for global malware distribution
The bait is artificial. The damage is real.
Google’s Mandiant division has exposed a widespread, Vietnam-based cyber campaign using the promise of next-gen AI video tools to infect unsuspecting users across the globe. The operation — linked to a threat group known as UNC6032 — has built an infrastructure of fraudulent websites, malicious ad placements, and custom infostealers, all carefully designed to ride the wave of global AI hype.
From fake platforms imitating Luma AI, Canva Dream Lab, and Kling AI to thousands of ads run across Facebook and LinkedIn, this campaign is exploiting curiosity, ambition, and the desire for new tools — turning everyday users into victims of highly targeted malware infiltration.
HOW THE SCAM WORKS
Fake AI Tool Sites
UNC6032 set up lookalike platforms offering text-to-video or image-to-video functionality. These sites mimicked the UI and tone of real AI innovation projects.
Malicious Ad Distribution
Thousands of social media ads were purchased — especially through Facebook, LinkedIn, and compromised accounts — reaching millions of users worldwide. Meta’s Ad Library, required under the EU’s Digital Services Act, revealed that over 2.3 million users in the EU alone were exposed to the fraudulent content.
Malware Delivery
Victims who attempted to use these bogus tools were served STARKVEIL malware — a strain built to silently exfiltrate:
- Login credentials
- Browser cookies
- Credit card data
- Facebook session tokens
- Device security status (AV software, timezone, camera presence)
Command-and-Control via Telegram API
Once deployed, the malware communicates through Telegram — a growing tactic among low-profile threat groups seeking to avoid traditional detection mechanisms.
THE AI DECEPTION: A GLOBAL ATTACK VECTOR
Mandiant tracked at least 30 domains used in the operation — with ads placed through both newly created and hijacked Facebook pages. Many of the sites rotated frequently to evade detection, using cloned interfaces and dynamic domain switching.
On LinkedIn alone, Mandiant found campaigns generating 50,000 to 250,000 impressions across users in the U.S., Europe, and Australia. These weren’t low-tier phishing efforts — they were full-fledged psychological operations wrapped in tech industry aesthetics.
As one Mandiant analyst noted:
“These AI tools no longer target just graphic designers; anyone can be lured in. The temptation to try the latest innovation makes everyone vulnerable.”
THE MALWARE: STARKVEIL PROFILE
STARKVEIL is not just a credential grabber. It behaves like a modular espionage platform, enabling:
- Backdoor installation
- Persistent access
- Live environment scanning
- Selective data exfiltration based on device analysis
The malware is designed to assess the value of the target before fully deploying heavier operations — suggesting the campaign may include selective targeting layered into broad-scale deployment.
AN OLD TRICK, NEW MASK
This isn’t the first time Mandiant — or the cybersecurity community — has seen AI-themed malvertising. In 2023, Bitdefender uncovered similar tactics, where hackers repurposed compromised Facebook accounts to spread product news loaded with infostealers disguised as legitimate tools.
But this marks the first global campaign leveraging fake AI video generators at this scale — weaponizing both the excitement and the ignorance around emerging AI platforms.
GOOGLE’S LARGER WARNING: THIS IS JUST ONE FRONT
Mandiant’s report was released in advance of the Google Safety Engineering Center’s inaugural Scams Summit, accompanied by a broader warning on modern digital fraud tactics:
- Fake travel booking platforms
- Fictitious package tracking pages
- Phony customer support popups
- Unpaid toll notice phishing SMS
Together, these represent the evolution of modern cybercrime — no longer brute force, but behavioral warfare. The fake AI tool is the new dream. And malware rides inside it.
TRJ CONCLUSION: WHEN THE PROMISE OF AI BECOMES THE PERFECT TRAP
The power of AI isn’t just reshaping industries. It’s now reshaping the attack surface of the internet. And as users scramble to be first in line for the next tool, exploiters are already there — waiting with poisoned bait.
This campaign proves one thing: even the excitement around innovation can be used as a weapon.
UNC6032 isn’t just pushing malware. They’re pushing the illusion of progress — and behind it, extracting the keys to your digital life.
This isn’t a one-off incident. It’s the prototype for what’s coming next.
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 1 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed.
🔥 Kindle Edition 👉 https://a.co/d/9EoGKzh
🔥 Paperback 👉 https://a.co/d/9EoGKzh
🔥 Hardcover Edition 👉 https://a.co/d/0ITmDIB
Get your copy today and experience poetry like never before. #InkAndFire #PoetryUnleashed #FuelTheFire
🚨 NOW AVAILABLE! 🚨
📖 THE INEVITABLE: THE DAWN OF A NEW ERA 📖
A powerful, eye-opening read that challenges the status quo and explores the future unfolding before us. Dive into a journey of truth, change, and the forces shaping our world.
🔥 Kindle Edition 👉 https://a.co/d/0FzX6MH
🔥 Paperback 👉 https://a.co/d/2IsxLof
🔥 Hardcover Edition 👉 https://a.co/d/bz01raP
Get your copy today and be part of the new era. #TheInevitable #TruthUnveiled #NewEra
🚀 NOW AVAILABLE! 🚀
📖 THE FORGOTTEN OUTPOST 📖
The Cold War Moon Base They Swore Never Existed
What if the moon landing was just the cover story?
Dive into the boldest investigation The Realist Juggernaut has ever published—featuring declassified files, ghost missions, whistleblower testimony, and black-budget secrets buried in lunar dust.
🔥 Kindle Edition 👉 https://a.co/d/2Mu03Iu
🛸 Paperback Coming Soon
Discover the base they never wanted you to find. TheForgottenOutpost #RealistJuggernaut #MoonBaseTruth #ColdWarSecrets #Declassified
Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!
https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
