Cyber threats exploiting AI are on the rise.

Global cybersecurity firm Mandiant has released the results of an investigation into a campaign by the Vietnam-linked threat group UNC6032 that exploited public interest in AI tools.

UNC6032 is carrying out attacks by impersonating brands such as Luma AI and Canva Dream Lab, popular AI video generation tools, to post malicious advertisements on social media and trick users into clicking them.

When users click on the ad, they are taken to a malicious site disguised as an AI tool, and when they download the file, an infostealer malware and backdoor are installed instead of actual AI content.

This allows attackers to secretly steal victims' login credentials, credit card information, and other sensitive data, which can then be traded on cyber black markets.

According to Mandiant’s M-Trends 2025 report, credential theft is the second-highest percentage of initial infection vectors, making it a serious security threat to both individuals and businesses.

Mandiant Threat Defense has identified thousands of malicious ads on social media platforms like Facebook and LinkedIn, and warns that similar campaigns are likely active on other platforms as well.

Accordingly, Mandiant is Meta and We published our findings in partnership with LinkedIn.

Meta has been working to detect and remove malicious ads, domains, and accounts since 2024, but emphasized that new malicious ads are constantly being created, requiring a stronger response.

Mandiant suggests several precautions to help users protect themselves from malicious ads impersonating AI tools.

Most legitimate AI websites require you to create an account or log in to fill out the prompts. Be wary of sites that don't require you to log in.

A normal AI website plays videos within the web browser itself (Chrome, Firefox, Safari, etc.) and does not require a separate file download.

Make sure it is in video format (.mp4), and avoid downloading if it is an .exe file.

Be suspicious of ads served by unverified accounts, accounts with few followers, or accounts with few AI-related posts.

“Threat actors are continually evolving their tactics, techniques, and procedures (TTPs), and this attack is an example of them leveraging the popularity of AI tools to weaponize malicious advertising,” said Yash Gupta, Senior Manager, Mandiant Threat Defense.

“Sophisticated malicious websites impersonating AI tools can pose a serious threat to both individuals and businesses,” Gupta warned. “Even if they appear harmless, you should be especially careful when accessing websites linked through advertisements.”