Loading malware…
EvilAI is a Windows malware campaign built around trojanized productivity-style applications that impersonate legitimate AI-enhanced tools such as document utilities and similar desktop software. The campaign has been publicly tracked since late 2025 and is associated with fake applications that present polished user interfaces, sometimes retain limited legitimate functionality, and in some cases are signed with valid code-signing certificates to improve trust and reduce suspicion. It has been observed targeting organizations globally across sectors including manufacturing, government, healthcare, technology, retail, education, finance, and construction, with notable victim concentration reported in India and the United States.
Technically, EvilAI is characterized by heavily obfuscated, AI-generated JavaScript executed through Node.js components embedded in the installer or application package. Its code uses anti-analysis and reverse-engineering resistance measures including control-flow flattening, Unicode-escape obfuscation, and logic designed to frustrate static inspection. After execution, it drops a JavaScript payload and establishes persistence through scheduled tasks and registry autorun mechanisms. The malware communicates with command-and-control infrastructure using encrypted JSON-based exchanges and can execute JavaScript or other instructions returned by the server, giving operators flexible post-compromise control.
Observed functionality supports use as an initial-access malware and modular stager. Reported command handling includes downloading additional content, modifying the registry, executing processes, and handling scripts. EvilAI has also been observed enumerating and terminating browser processes through WMI in order to access browser profile data, including files associated with stored credentials and settings, indicating credential-theft objectives. Reporting has further linked EvilAI-themed applications to ransomware intrusion chains, where the fake AI tools provide covert footholds for follow-on operators. Distribution has been associated with malicious websites, SEO manipulation, social-media promotion, and malicious advertising, consistent with a broad social-engineering-driven delivery model.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
“EvilAI further leverages Windows Management Instrumentation (WMI) to enumerate browser processes…”
This allows me to look at the scheduled task that gets dropped, as well as the JS file, and some of the workings of this application.
“The payload establishes persistence through scheduled tasks… ensuring daily execution at 10:51 AM and every four hours thereafter.”
This allows me to look at the scheduled task that gets dropped, as well as the JS file, and some of the workings of this application.
This allows me to look at the scheduled task that gets dropped, as well as the JS file, and some of the workings of this application.
In Process Hacker I can see the POST. The Payload can be decoded in cyberchef... You will get something like: {"Event":"heartbeat","MachineId":"f4f34c43-9bc1-4a9a-b55f-1d4dd97e0e88","SessionId":"125cc3b3-bc56-474d-817b-badc96d07202","Version":"0.0.2","OSVersion":"10.0.26100","args":""}
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware disguised as fake AI productivity applications and used to provide ransomware actors with initial access.
Malware delivered via trojanized/masqueraded AI or productivity tools to infiltrate organizations across multiple regions.
Malware distributed as trojanized 'AI productivity' applications (e.g., PDF tools), signed with valid certificates and pushed via malvertising/SEO/social links.
EvilAI is a Node.js-executed, AI-obfuscated JavaScript malware delivered via trojanized fake productivity apps (often signed with valid certificates). It establishes persistence (scheduled tasks and Run keys), uses WMI to enumerate/kill browser processes, steals browser data by copying profile files (e.g., Web Data/Preferences), and maintains encrypted (AES-256-CBC) C2 communications to receive JSON commands for downloading files, modifying registry, executing processes, and handling scripts. It may act as a stager to deploy secondary infostealer payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.