Microsoft warns AI chatbots may be sending victims to malicious websites

• Microsoft researchers observed cybercriminals adapting SEO poisoning tactics to AI platforms, tricking AI into recommending spoofed utility sites like HWMonitor and CrystalDiskInfo
• Victims who follow these AI‑suggested links download malware via DLL sideloading, which installs ScreenConnect for attacker access and can lead to cryptojacking
• Defenders should treat AI recommendations with the same caution as search results, verifying links before downloading to avoid compromise

With the advent of AI, internet search habits among most users have drastically changed, with the way cybercriminals deliver malware to their victims also changing as a result.

In the years before AI, crooks would use the “SEO poisoning” technique to trick search engines into showing malicious and fraudulent websites at the very top of search engine results pages. By leveraging the trust users had in these engines, crooks could expect the malware to be downloaded without much scrutiny.