This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The Russian hacker group FIN7 has launched a campaign using fake 'nudify' websites to distribute infostealer malware. These sites lure users interested in AI-generated nonconsensual nude imagery by offering 'free downloads' or 'free trials' of deepfake software. Instead of providing the promised AI functionality, the sites deliver malicious payloads, including Redline Stealer, Lumma Stealer, and NetSupport RAT, which are used to harvest credentials and facilitate financial fraud or ransomware attacks.
The hacker group FIN7 is allegedly behind fake AI "nudify" websites distributing infostealer malware to users, according to an investigation by Silent Push. These sites are reported to lure individuals seeking deepfake AI tools into downloading malware disguised as software to "nudify" photos. The malware steals sensitive data from victims, which is used for extortion or financial fraud. FIN7's activity on this front reportedly marks the revival of a group previously declared defunct by the U.S. Department of Justice.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The threat actors used the lure of AI deepfake generation tools to orchestrate a scam, deceiving users into downloading credential-stealing malware for financial gain.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The risk and subsequent harm were directly caused by human threat actors (FIN7) intentionally deploying malicious honeypot websites that leveraged the popularity of generative AI as a lure.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
The Russian cybercriminal group FIN7 exploited public interest in AI deepfake generators by setting up fake 'nudify' websites to distribute infostealer malware. While the incident demonstrates how generative AI trends are used as social engineering lures, the actual national security impact remains minor, primarily posing traditional cybersecurity and financial fraud risks.
The reports focus on a malware distribution campaign that used the promise of AI deepfake generation as a lure. Because no actual AI system was deployed or operated during the incident, its behavioral mode cannot be characterized.
Limited Risk: The campaign leveraged the concept of AI-generated deepfakes. Under the EU AI Act, AI-generated content such as deepfakes falls under Limited Risk (Level 3) due to transparency obligations, though the actual system here was a malicious spoof.
The malicious websites specifically advertised an AI-powered 'Deepnude Generator' to lure victims, promising to digitally undress clothed photos.
The reports from Silent Push and other cybersecurity outlets provide highly detailed technical analysis of the malware, domain names, and the mechanics of the FIN7 campaign. The role of AI as a social engineering lure is clearly documented, leaving little ambiguity about the nature of the threat.
None. The campaign is clearly a financially motivated cyberattack using AI-themed social engineering.
Technology
Generative AI Image Models
Public availability of generative AI image models enables deepfake site creation.
Malware Wrapped in AI Tools
Threat actors hide info-stealers inside fake AI generator executables.
Data Inputs
User Photo Uploads
Users upload real-life photos to fake AI sites, exposing private data.
Human Factors
Demand for Nonconsensual AI Nudes
Users proactively seek creepy deepfake AI software, ignoring safety risks.
Unsuspecting Employee Actions
Employees download malicious files, compromising domain-joined machines.
Process and Methods
SEO Manipulation of AI Sites
Threat actors use SEO tactics to boost malicious AI sites in search results.
Deceptive Free Trial Flows
Sophisticated multi-step trials trick users into downloading payloads.
Management
Lack of Enterprise Domain Blocking
Organizations fail to block access to shady AI deepfake honeypots.
Regulatory Environment
Proliferation of Nudify Websites
Rapid rise of deepfake sites outpaces legal and regulatory enforcement.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
