When AI Turns Against You: The Malvertising Trap of Kling AI

In early 2025, attackers launched a deceptive campaign by impersonating Kling AI, to trick users into downloading malware. Promoted heavily through fake social media ads, the campaign led victims to a bogus website where they were lured into clicking a button only to receive a malicious ZIP file containing a disguised Windows executable. This file triggered a stealthy loader, designed to evade detection, establish persistence, and inject a second-stage payload. That payload was a customized PureHVNC Remote Access Trojan (RAT), capable of full system control, surveillance, and data theft.