# Attackers Manipulate AI Chatbots (ChatGPT, Gemini, Copilot, AI Overviews) via SEO/Content Poisoning for Mass Disinformation, Malvertising, and Cryptojacking

> Multiple independently-operating threat clusters are seeding the web with SEO-optimized malicious pages and prompt-injection payloads so that AI chatbots and AI-generated search summaries (ChatGPT, Google Gemini/AI Overviews, Microsoft Copilot, Claude, Perplexity, Grok) ingest and surface attacker-controlled content as trustworthy. Confirmed technical incidents include a Microsoft-documented cryptojacking campaign where ChatGPT recommended malware-laced software downloads, a 'LLMShare' malvertising scheme abusing ChatGPT/Claude shared-conversation pages, an 'AI Recommendation Poisoning' prompt-injection technique that persists false 'trusted source' instructions in AI assistant memory, and a Kremlin-linked 'Pravda'/Portal Kombat network whose LLM-grooming operation gets false narratives repeated as fact by major chatbots.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2631
- **ID:** TL-2026-2631
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Pravda network operators  for the disinformation thread (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat tracks the emergent technique class of poisoning AI chatbot and AI-search outputs by manipulating the web content and query parameters those systems ingest, rather than exploiting a software vulnerability. Four distinct, evidence-backed clusters fall under this umbrella:

1. AI-chatbot-driven cryptojacking (Microsoft Defender, disclosed 2026-05-26): threat actors built 150+ malicious subdomains of gleeze[.]com hosted behind Dynu dynamic DNS, impersonating popular system utilities (CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, PDFgear) that target GPU-owning users. Users searching for these tools via search engines AND via AI chatbot software recommendations were directed to the malicious domains. The downloaded ZIP bundles a legitimate executable with a malicious autorun.dll that is sideloaded, which installs a ScreenConnect remote-access client (disguised as vcredist_x64.dll via msiexec.exe) that calls back to 193.42.11.108. SimpleRunPE.exe then establishes six persistence mechanisms, hollows Microsoft-signed binaries, disables Defender exclusions, checks for analysis tools (taskmgr.exe, Process Hacker, Process Explorer, System Informer), and deploys one of three GPU cryptominers (gminer, lolMiner, SRBMiner-MULTI). The established ScreenConnect access could later support data theft, lateral movement, or ransomware.

2. LLMShare malvertising (Push Security, disclosed 2026-05-29): attackers abuse the native 'share' features of ChatGPT and Claude to host convincing fake service-disruption notices or fake installation guides at trusted chatgpt.com/s/ and claude.ai/share/ URLs, then drive traffic to them via malvertising/SEO on searches for 'chatgpt', 'chatgpt free', and common typos. Clicking through redirects to a ChatGPT clone at openew[.]app that delivers a VirusTotal-flagged malicious executable. The infrastructure conditionally renders a benign generic AR/VR page to automated scanners while showing the malicious flow to real victims.

3. AI Recommendation Poisoning / prompt injection (Microsoft, disclosed 2026-02-10): legitimate businesses (and by extension, attackers) embed hidden instructions in 'Summarize with AI' deep-link URLs (e.g. copilot.microsoft.com/?q=..., chat.openai.com/?q=..., claude.ai/new?q=...) that, when clicked, cause the assistant to permanently 'remember' a domain as a trusted citation source or accept injected marketing copy as product fact. Microsoft found over 50 unique prompts from 31 companies across finance, healthcare, legal, SaaS, and security sectors. Enabling tooling includes the npm package CiteMET and the 'AI Share URL Creator' web tool, both marketed openly as 'SEO growth hacks for LLMs.' This is the same mechanism a malicious actor could use to poison AI assistant memory toward phishing or malware-serving domains.

4. LLM grooming for disinformation (NewsGuard investigations, ongoing through 2026): the Pravda network (aka Portal Kombat, identified by France's Viginum in Feb 2024) is a cluster of 370+ pro-Russian websites that published roughly 6 million articles in 2025 across dozens of languages, engineered less for human readers than for AI training-data and retrieval-augmented ingestion. NewsGuard's repeated testing of ChatGPT, Copilot, Mistral's chat, and Google AI Overviews/Lens found major chatbots repeating Pravda-seeded false narratives as verified fact in 33% of cases (March 2025) rising to roughly half of tested cases by January 2026. Storm-1516, an influence operation associated with former Florida deputy sheriff John Mark Dougan (now based in Russia), has been documented theorizing AI-targeted disinformation strategies.

A related, adjacent pattern documented by ZeroFox and Huntress uses .edu/.gov-hosted fake PDFs and forum reposts to seed false brand customer-support phone numbers that AI Overviews, Gemini, and ChatGPT then surface to users as legitimate contact information -- a phishing/vishing precursor technique using the same SEO-poisoning primitive. Zscaler ThreatLabz separately documented black-hat SEO campaigns using AI-tool branding (ChatGPT, Luma AI) on WordPress sites with multi-layer JS redirection to distribute the Vidar and Lumma infostealers and Legion Loader.

Collectively these clusters demonstrate that AI chatbots' real-time web retrieval and citation behavior can be reliably manipulated at scale using nothing more than search-engine-optimized content, malvertising, and crafted URLs -- no exploit or CVE required -- letting attackers bypass traditional security scrutiny (URL reputation, spam filters) because the malicious link or claim arrives wrapped in a trusted AI-synthesized response.

## MITRE ATT&CK

- T1608.006 SEO Poisoning
- T1583.001 Domains
- T1583.008 Malvertising
- T1608.001 Upload Malware
- T1204.001 Malicious Link
- T1036.005 Match Legitimate Resource Name or Location
- T1574.001 DLL
- T1218.007 Msiexec
- T1219 Remote Access Tools
- T1055.012 Process Hollowing
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1685 Disable or Modify Tools
- T1518.001 Security Software Discovery
- T1496 Resource Hijacking
- AML.T0051 LLM Prompt Injection

## Sources

- [Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign](https://www.darkreading.com/threat-intelligence/attackers-manipulate-ai-chatbots-mass-disinformation-phishing-campaign)
- [AI-Themed SEO Poisoning Attacks Spread Info, Crypto Stealers](https://www.darkreading.com/cyberattacks-data-breaches/ai-seo-poisoning-attack-info-crypto-stealers)
- [Black Hat SEO Poisoning Search Engine Results For AI to Distribute Malware](https://www.zscaler.com/blogs/security-research/black-hat-seo-poisoning-search-engine-results-ai-distribute-malware)
- [LLMShare: using shared chatbot pages to distribute malware](https://pushsecurity.com/blog/llmshare-malvertising-campaign)
- [AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites](https://thehackernews.com/2026/05/ai-chatbot-recommendations-redirect.html)
- [From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities](https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/)
- [GPU mining malware spreads via SEO poisoning, AI chatbots](https://www.bleepingcomputer.com/news/security/gpu-mining-malware-spreads-via-seo-poisoning-ai-chatbots/)
- [SEO Poisoning: How Threat Actors Are Tricking AI Models like ChatGPT, Gemini, and CoPilot](https://www.zerofox.com/blog/seo-poisoning-llms/)
- [Manipulating AI memory for profit: The rise of AI Recommendation Poisoning](https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/)
- [AI chatbot responses polluted by pro-Russian disinformation](https://www.france24.com/en/technology/20260603-ai-chatbot-responses-polluted-pro-russian-disinformation)
- [What Is AI Poisoning? How Attackers Corrupt AI Responses](https://www.huntress.com/generative-ai-guide/what-is-ai-poisoning)
- [Hackers Abuse Fake Utility Downloads to Install ScreenConnect and Mine Cryptocurrency](https://cybersecuritynews.com/hackers-abuse-fake-utility-downloads/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2631