AI Chatbot Cryptojacking Campaign Targets GPU Users via Malicious Software Sites

Microsoft has uncovered an active cryptojacking campaign that leverages artificial intelligence chatbot interactions to deliver malicious software to users searching for trusted system utilities. The campaign impersonates legitimate GPU-monitoring tools and establishes persistent remote access through abused ScreenConnect deployments, marking a significant evolution in social engineering tactics.

What Happened: AI Chatbot Cryptojacking Campaign Targets GPU Users

Microsoft Defender Experts and the Microsoft Defender Security Research Team published a report on May 26, 2026, detailing a sophisticated cryptojacking operation that uses AI chatbot recommendations to direct users to malicious download sites. This emerging delivery technique extends traditional search engine optimization poisoning into the realm of large language model interactions.

The campaign specifically targets users likely to own high-performance GPUs by impersonating trusted system utilities such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. Furthermore, the threat actors establish persistent remote access through ScreenConnect installations, enabling follow-on activities including data theft, lateral movement, or ransomware deployment.

Technical Details of the AI Chatbot Cryptojacking Attack

The attack chain begins when users search for common system utilities on search engines or query AI chatbots for software download recommendations. In April 2026, Microsoft observed users being directed to attacker-controlled domains through LLM-generated responses containing malicious links. VirusTotal scan metadata corroborated these AI-assisted delivery patterns.

Each fake site presents a download button that retrieves a ZIP archive from a campaign-specific subdomain of gleeze.com, hosted through Dynu dynamic DNS infrastructure. Since March 2026, Microsoft has identified more than 150 malicious domains serving these payloads.

Malware Delivery and Execution Chain

The downloaded ZIP contains a legitimate utility executable alongside a malicious DLL named autorun.dll. When the user launches the executable, the legitimate program loads the malicious DLL via DLL sideloading. This technique requires no exploitation and generates no visible anomaly to the user.

The malicious DLL uses msiexec.exe to silently install a second DLL named vcredist_x64.dll, which is actually a packaged installer for ScreenConnect remote management software. Once installed, the ScreenConnect client continuously communicates with the attacker-controlled server at 193.42.11[.]108.

Process Hollowing and Defense Evasion

After establishing the ScreenConnect session, the attacker drops a binary named SimpleRunPE.exe. This dropper copies itself to a hidden folder as RuntimeHost.exe and establishes six persistence mechanisms:

• Three scheduled tasks (Windows System Health, Windows System Health Monitor, Windows System Health Check)
• Two registry Run keys (HKLM and HKCU)
• One Startup folder shortcut

The malware then performs process hollowing into one of seven legitimate Microsoft-signed .NET binaries: InstallUtil.exe, RegAsm.exe, RegSvcs.exe, MSBuild.exe, AppLaunch.exe, AddInProcess.exe, or aspnet_compiler.exe. This causes the malicious mining code to run under the identity of a trusted Windows utility.

Moreover, the malware invokes PowerShell to add Microsoft Defender exclusions for 13 processes, including all seven .NET hollowing targets and various miner binaries. Anti-analysis checks detect virtual machines and 40 analyst tools, terminating execution if any are found.

Command and Control Infrastructure

The attacker server address is encrypted using AES-128-CBC and resolves to wss://minemine.gleeze.com:8443/ws. The malware hardcodes a TLS certificate SHA-256 fingerprint for certificate pinning during the WebSocket handshake.

Three additional IP addresses have been identified presenting the same TLS certificate:

• 93.115.10.35
• 198.23.185.238
• 2.59.132.106

Certificate pivoting also revealed linked campaigns using the giize.com DynamicDNS domain with similar SEO poisoning tactics.

Business and Operational Impact

This campaign represents more than a typical cryptojacking operation. The threat actors demonstrate strategic targeting and multi-stage monetization capabilities.

• GPU Resource Theft: The malware downloads and executes one of three GPU-focused miners (gminer, lolMiner, or SRBMiner-MULTI) based on host capabilities
• Persistent Remote Access: ScreenConnect installations provide ongoing access for data theft, lateral movement, or future ransomware deployment
• User Activity Monitoring: The malware monitors GPU usage and idle time, terminating mining when users are active to avoid detection
• Process Termination Evasion: Mining stops if Task Manager, Process Explorer, or other analysis tools are detected
• Enterprise Risk: Compromised endpoints with high-performance GPUs often exist in engineering, design, and research environments containing valuable intellectual property

Consequently, organizations face both immediate resource theft and long-term exposure to more severe follow-on attacks.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Enable cloud-delivered protection in Microsoft Defender Antivirus or equivalent endpoint protection platforms
2. Activate attack surface reduction rules to block DLL sideloading and script-based malware delivery
3. Enable network protection and web protection in endpoint security solutions
4. Deploy SmartScreen or equivalent URL filtering to block malicious domains
5. Hunt for ScreenConnect installations communicating with 193.42.11[.]108 or domains under gleeze.com and giize.com
6. Check for persistence mechanisms matching the Windows System Health task names or WinSysCache registry entries
7. Review Defender exclusion lists for unauthorized entries covering .NET utilities or miner binaries

User Awareness and Policy

Organizations should remind employees that workplace credentials should not be stored in personal browser password vaults. Additionally, users should verify software downloads against official vendor websites rather than relying solely on search engine or chatbot recommendations.

Administrators can disable browser password syncing on managed devices through Group Policy. Microsoft Edge and other browsers with SmartScreen support provide additional protection against malicious websites.

Bottom line: This campaign demonstrates that threat actors are actively exploiting trust in AI chatbots to deliver malware. Organizations must treat AI-generated recommendations with the same skepticism applied to traditional search results and enforce endpoint controls that block the full infection chain from initial access through persistence.

Incident Summary

Incident:	AI Chatbot Cryptojacking Campaign
Affected Systems:	Windows endpoints with high-performance GPUs
Disclosure Date:	May 26, 2026
Patch Status:	N/A — mitigation and detection-based response
Threat Actor:	Unattributed
Initial Access:	SEO poisoning and AI chatbot recommendation manipulation
Persistence:	ScreenConnect, scheduled tasks, registry Run keys, Startup folder

References

1. Microsoft Defender Experts and Microsoft Defender Security Research Team, “From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities,” Microsoft Security Blog, May 26, 2026, https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/, accessed May 27, 2026.
2. The Hacker News, “AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites,” May 27, 2026, https://thehackernews.com/2026/05/ai-chatbot-recommendations-redirect.html, accessed May 27, 2026.