AI Search Poisoning Hits ChatGPT, Gemini, and Google AI Overviews
Attackers flood the web with fake support pages so ChatGPT, Gemini, and Google AI Overviews return phishing phone numbers and login pages.
The Hacker News weekly security bulletin this week collects 14 developments, and the through-line is that trusted paths are being poisoned. The most visible example is an AI search poisoning campaign described by Vigilance Security's Ariel Simon: attackers are flooding the web with carefully optimized posts, PDFs, reviews, and fake support pages so that ChatGPT, Gemini, and Google AI Overviews return fraudulent phone numbers, email addresses, and login pages when users search for everyday information about major companies. Targets include Delta, Lufthansa, Qatar Airways, Chase, Bank of America, Airbnb, TripAdvisor, and several others. According to Simon, the fake content is uploaded to social media, file-sharing sites, website hosting platforms such as Google Sites, GitHub Pages, WordPress, and Blogger, as well as fundraiser, job search, and event platforms, and even to reviews on Yelp and Apple Maps.
Among AI-related threats, Group-IB documented a previously unknown Android banking trojan called RemControl. It targets retail banking customers in Western Europe (Italy, France, Spain, Poland, Portugal), the Middle East, and Canada, and is distributed through fake Google Play Store pages impersonating the TVTap IPTV application, promoted through Meta ads. First observed in July 2026, the malware abuses Android's Accessibility Service, a feature designed to help users with disabilities, to inject phishing overlays over legitimate banking apps, stream the device screen in real time, log keystrokes, and give the operator full remote control. Its command-and-control (C2) address is resolved through an encrypted Telegram dead-drop, a technique that lets attackers rotate infrastructure without recompiling the malware. Group-IB says both the operator panel documentation and phishing overlays contain artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a live phishing page. Russian-language code comments point to a Russian-speaking developer, and campaign similarities suggest a possible link to the Medusa UNKN affiliate botnet.
AI coding tools also created privacy problems. Z.ai disabled several features of its ZCode coding assistant after a default setting was caught sending users' local code repositories to Alibaba Cloud servers in China without their consent. This came a couple of months after SpaceXAI's Grok Build coding command-line interface was found uploading entire Git repositories to a Google Cloud Storage bucket under its control. Z.ai has since turned off the workflow that generated and uploaded local repository snapshots and opened its codebase for public review, but the episode raises fresh concerns for enterprises about how AI tools handle sensitive source code.
Critical infrastructure and surveillance issues rounded out the week. The FBI and CISA published a fact sheet urging owners and operators to limit access for third-party industrial control system (ICS) integrators and apply the principle of least privilege, meaning each person or service gets only the access it truly needs. A separate forensic study from researchers at the University of Michigan, University of Calgary, Georgia Institute of Technology, and Indian Institute of Technology Delhi examined MAX, the state-backed Russian super-app developed by VK. They found five capabilities that effectively make MAX a man-in-the-middle for all mini-app interactions: it can capture screenshots without special permissions or alerts, read and write all mini-app local storage, inject JavaScript into running mini-apps, mediate all mini-app network traffic (and in the Russian regional build route it through a GOST TLS proxy), and control authentication tokens to impersonate any user to any service inside the super-app. Meanwhile, Malwarebytes reported a fake Claude Max giveaway that uses a browser-in-the-browser (BitB) attack. There is no form for card details and no download; instead, the page offers a free upgrade and asks the victim to sign in with Google. Clicking the Google button does not open a real Google sign-in window; it draws a fake window inside the existing tab with a padlock and a correctly spelled Google address, which can even be dragged around.
Endpoint detection and response (EDR) evasion and kernel patching also advanced. In July 2026, researchers Max Hirschberger and Ogulcan Ugur detailed Process Parameter Poisoning, and Flashpoint has released a proof-of-concept in Rust. The technique combines process parameter spoofing and thread execution hijacking to inject code into foreign processes without calling memory-accessing APIs, instead hiding the payload inside standard process initialization structures. This blinds traditional API-hooking EDR agents during early code execution. Canonical announced it will shift Ubuntu kernel fixes to a unified two-week release cycle, merging the previous four-week Stable Release Updates and two-week security fix schedules. The company said the recent explosion in CVE volume, mainly driven by AI, prompted the change. Recurring two-week cycles overlap, so kernel releases will happen weekly; the first week focuses on kernel package preparation.
Website owners face two direct threats. Sekoia exposed Exvicy, a new ClickFix malware distribution framework advertised as malware-as-a-service (MaaS) on Exploit.in since May 26, 2026. It launched at $1,200 per month and rose to $2,000 in mid-August, with the operator claiming detections are becoming daily. Exvicy uses the Windows Run dialog on fake Cloudflare CAPTCHA checks injected into compromised WordPress sites to distribute malware. Researcher Quentin Bourgue said it is a copycat of ErrTraffic, directly reusing its injected JavaScript, ClickFix HTML, and C2 communication logic. Separately, a malicious version of the Admin Menu Editor Pro plugin for WordPress was uploaded to adminmenueditor.com on September 14, 2026. Version 2.35 included a file called includes/wp-user-consent.php that installs a web shell, a backdoor script, on the user's site. A clean version 2.36 was pushed the same day but was compromised again, suggesting root-level server access. Maintainer Janis Elsts released version 2.37 on September 20. The root cause was an outdated Linux kernel vulnerability, with the earliest sign of compromise on September 13 at about 7:40 p.m. UTC. At least 230 customers installed the malicious update on 1,500 sites, and the maintainer is rebuilding the update server and licensing API.
Supply chain and phishing also hit developers and users. SafeDep disclosed that on September 8, 2026, an unknown threat actor added a malicious source dependency to Deep-Live-Cam, a Python face swapping application with 96,600 GitHub stars. The dependency loads a cryptocurrency clipboard hijacker for Windows and macOS that replaces wallet addresses in clipboard text and registers itself to run at login. SafeDep also detected an npm package named ulid-xyz that typosquats as ulidx, a technique
How to Protect Yourself
- If an AI assistant gives a support phone number or login page, go to the company's official website by typing the address yourself instead of clicking or calling the result.
- Never enter your Google or other account password into a pop-up window that appeared inside a webpage; open a new browser tab and type the real service name to check.
- If you run a WordPress site, install plugin updates only through the WordPress dashboard or the developer's official website, and be suspicious if a plugin suddenly shows an unexpected version number.
- Enable two-factor authentication on your Google, OpenAI, and hosting accounts so a stolen password alone cannot unlock them.
- Treat urgent emails about invoices or service interruptions as suspicious; contact the company directly through a known support page rather than the link in the message.
- Review the permissions and repository access of any coding assistant or AI tool before connecting it to your code, and turn off automatic repository uploads if you did not enable them.
Terms Explained
- command-and-control (C2) A server or channel that attackers use to send instructions to malware on infected devices and receive stolen data.
- browser-in-the-browser (BitB) A fake browser login window drawn inside a real webpage to trick people into entering passwords into an attacker's page.
- endpoint detection and response (EDR) Security software that watches computers and servers for suspicious activity and can respond automatically to stop threats.
- malware-as-a-service (MaaS) A paid subscription service where criminals rent ready-made malware and infrastructure to run their own attacks.
- web shell A hidden script placed on a website that lets an attacker run commands on the web server remotely.
- cache poisoning A technique where an attacker puts malicious data into a shared storage area so that a trusted system later uses it as if it were safe.
- postinstall hook A script that runs automatically right after a software package is installed, often used to set up the program but sometimes abused to launch malware.