HookedWing

HookedWing is a malware delivery campaign that abuses trusted AI-platform sharing features and search-driven traffic acquisition to compromise macOS and Windows users. The operation has been associated with long-running infrastructure abuse across GitHub Pages and Vercel and has been observed using malvertising and SEO poisoning to steer victims to attacker-controlled content hosted on legitimate services. A notable tradecraft pattern is the use of shared pages on major AI chatbot platforms to present malicious installation instructions or convincingly rendered fake service notices, leveraging the reputation of trusted domains to evade conventional URL-based defenses. Observed delivery chains include social engineering that instructs victims to execute terminal commands and variants that imitate legitimate desktop application download workflows. The campaign has used cloned software download pages and conditional rendering to present benign content to scanners while showing malicious content to real users, indicating deliberate defense-evasion measures. Reporting has characterized these attacks as part of the InstallFix/ClickFix family of user-execution schemes, with search results serving as a primary initial-access vector rather than email. HookedWing demonstrates capabilities spanning initial access, defense evasion, and post-compromise malware delivery. The operation targets end users seeking popular AI tools and abuses legitimate web platforms as attack infrastructure. Available information supports financially motivated malware distribution, but does not firmly attribute the activity to a specific state sponsor or country of origin.