Does this concern you?
- Affected: Windows PCs where people install AI desktop apps from search results themselves, above all with admin rights.
- Skip it if: your users have no admin rights and nobody enters an admin password for them. According to Check Point, without admin rights the dropper shows "Please run this program as Administrator." and exits.
What to do
- Tell colleagues to get AI desktop apps from the vendor's website, not a GitHub project a search engine ranked first.
- Remove local admin rights where the job doesn't need them. Without them the installer quits and asks for admin rights – so don't type the admin password in for an "AI app" a colleague found online.
- On Windows PCs whose users have admin rights, type C:\ProgramData\WMProcess into the Explorer address bar: a copy of WMPDMC.exe and wmpdui.dll there are the sign. In Task Scheduler, look for a task by "Microsoft Corporation" described as "Collects device metadata for Windows Media Player." A Setup.exe with a winmm.dll beside it in Downloads means someone fetched the bait.
- Found the folder or the task? Take the PC off the network and reinstall it. The loader runs as Local System and fetches whatever the attacker chooses, so deleting the folder is not enough.
- Don't: read a valid vendor signature as a verdict on the whole download. It vouches for one file, not the DLL beside it.
What we know – and what we don't
- Check Point thinks SEO poisoning most likely put the projects high on Google; the GitHub.io pages link straight to the ZIPs.
- Check Point says the malware avoids its own command servers and goes through Telegram, Tor, Catbox and Google's DNS-over-HTTPS, which makes its traffic harder to tell apart from normal use.
- Check Point says detection rates were so low the attackers left the ZIPs without a password.
- The loader can inject its download into svchost.exe or run it as a program or PowerShell script. Check Point is the only source so far.
Why it matters
No email, no attachment: someone searches for the newest model, clicks the top result, lands on GitHub, and the installer carries a signature they trust. What stops it is unglamorous: no admin rights for daily work, no admin password typed in for a stranger's installer, and the habit of fetching tools from the vendor. Every new AI model name is fresh bait.