Microsoft warns AI chatbots are luring users to cryptojacking malware disguised as trusted PC utility downloads

Microsoft has warned users about an active cryptojacking campaign that uses AI chatbots to serve malicious downloads disguised as trusted PC utilities. Microsoft Defender Experts and the Security Research Team said in a report published Tuesday that "this emerging delivery technique extends social engineering beyond conventional search results and increases the visibility of malicious software recommendations."

The campaign impersonates legitimate system utilities like CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. The idea is to target applications favored by PC users with high-performance GPUs to gain access to systems with higher cryptocurrency mining potential, rather than infecting a large number of machines at random.

3

Downloads from this cryptojacking campaign have also been found to establish persistent remote access through ScreenConnect deployments. ScreenConnect, also known as ConnectWise Control, is a legitimate remote management tool widely used by IT administrators, but it can also be leveraged for data theft, lateral movement, or ransomware.

The attack uses two techniques to push users into downloading infected utilities instead of the official ones. SEO poisoning creates malicious websites that mimic legitimate ones and are engineered to rank highly for queries like "download HWMonitor" or "latest CrystalDiskInfo." At the same time, attackers manipulate AI chatbots by influencing their training data to recommend attacker-controlled domains as trusted download sources.

3

In April 2026, Microsoft identified cases in which users were directed to malicious websites through interactions with LLM-based chatbots rather than through traditional search engine results. Links were provided to malicious downloads masquerading as official ones, bypassing long-trusted websites in favor of newly established fake ones that exploit the recommendation system. Despite these safety concerns, companies continue to push AI responses deeper into search results, with Google recently doubling down on AI, making AI Mode and Gemini central to Search.

That said, if you want to keep your PC malware-free, it's better to avoid relying on AI chatbots to download such system utility tools. Instead, manually visit official sources and, even if you do use AI recommendations, double-check that they point to legitimate, verified websites before downloading anything.