Microsoft: cryptojacking campaign uses AI chatbot recommendations and SEO poisoning to push fake GPU utilities, deploys ScreenConnect persistence

Microsoft has warned of an active cryptojacking campaign that surfaces malicious download sites through AI chatbot recommendations, extending SEO poisoning beyond conventional search. Attackers impersonate legitimate system utilities - CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, PDFgear - to target users with high-performance GPUs, prioritizing mining yield per host over mass infection. Beyond mining, the operators deploy ScreenConnect for persistent remote access enabling data theft, lateral movement, or ransomware. Victims who ask LLM-based tools for software-download recommendations are served links to attacker domains on subdomains of gleeze[.]com, hosted via Dynu dynamic DNS. Microsoft says it has detected and blocked the activity.

Check

Hunt for ScreenConnect installs you did not authorize and traffic to gleeze[.]com subdomains or Dynu dynamic-DNS hosts. Flag downloads of GPU/hardware utilities from non-official domains.

Affected

Users with high-performance GPUs who download system utilities (CrystalDiskInfo, HWMonitor, FurMark, etc.) via search results or AI chatbot recommendations. Gaming, engineering, and ML workstations at highest risk.

Fix

Block gleeze[.]com and known Dynu C2 at egress. Source utilities only from official vendor sites. Educate users that AI-chatbot download links can be SEO-poisoned. Monitor GPU-utilization anomalies.