In September 2025, Trend Micro researchers published details of a malware campaign they named EvilAI. Its operators disguised malware as useful AI-powered and productivity applications, such as PDF editors, browsers and recipe or manual finders, and used code that appears to have been written with AI assistance to make those apps look clean and legitimate. The apps worked as advertised, were signed with valid certificates, and quietly gave attackers a foothold inside organizations around the world.

EvilAI is worth understanding not because it is science-fiction “thinking” malware, but because it shows how attackers are using AI in practice: to produce convincing, working software at scale that slips past both users and signature-based defenses. This article explains what was found, what it means, and how to defend against it.

What EvilAI is, and what it is not

Early social media coverage, including our own first version of this post, described EvilAI as self-improving code that morphs its behavior in real time. The research does not support that description. EvilAI is better understood as a malware family and distribution campaign in which AI helps attackers produce legitimate-looking software, not as malware that reasons or evolves on its own.

According to Trend Micro and reporting that followed, the operators distributed at least eight fake applications, including names such as AppSuite, Epi Browser, JustAskJacky, Manual Finder, OneStart, PDF Editor, Recipe Lister and Tampered Chef. The applications were promoted through newly registered websites that imitate vendor portals, malicious advertising, search engine manipulation and download links shared on forums and social media.

The code behind them was clean, well structured and commented in a way researchers associated with AI-generated code. That matters because the applications look like ordinary, competently built software, which makes them harder to flag by appearance or by static signatures.

How the attack works

The attack chain relies on trust at every step:

1. Lure: a user searching for a free PDF editor or AI productivity tool finds a professional-looking download page, often via an ad or search result.
2. Trust signals: the installer is digitally signed. Researchers found the operators abused code-signing certificates issued to short-lived companies registered in several countries, rotating them over time.
3. Working app: the application does what it promises, so the user has no reason to be suspicious.
4. Hidden stager: in the background, the malware performs reconnaissance, checks which security products are installed, steals browser data, and maintains encrypted communication with attacker-controlled servers so further payloads can be delivered.

Trend Micro reported the highest infection levels in India, the United States, France, Italy, Brazil, Germany, the United Kingdom, Norway, Spain and Canada, with manufacturing, government, healthcare, technology and retail among the most affected sectors. Researchers also connected the activity to related malware, including the TamperedChef information stealer and the BaoLoader backdoor.

Why traditional defenses struggle

Three things defeat older defenses here. A valid signature makes the installer look trustworthy to both users and some security tools. Functional software removes the obvious signs of fraud. And clean, freshly generated code gives signature-based antivirus little to match against. The result is an asymmetry: attackers can produce new, convincing variants cheaply, while defenders relying on known-bad lists are always one step behind.

This is the pattern we describe in AI-Powered Threats: Cyberattacks Are Getting Smarter. AI rarely creates a new category of attack. It makes existing ones, in this case trojanized free software, cheaper and more convincing.

EvilAI is not an isolated case. In August 2025, Anthropic reported that a criminal with limited technical skills had used its AI models to develop and sell ransomware with evasion features they could not have built alone. The common thread is that AI lowers the skill and time needed to produce working, polished malicious software. Defenders should expect more campaigns that look like EvilAI: large numbers of plausible, functional applications, each slightly different, distributed through the same channels legitimate software uses.

How to defend against EvilAI-style threats

The defenses that work are about controlling what runs and watching how it behaves:

• Control software installation. Remove local administrator rights from everyday users and use application allowlisting or an approved software catalog, so free tools cannot be installed on a whim.
• Use behavior-based endpoint detection. EDR tools that watch for suspicious actions, such as a PDF editor enumerating security products, reading browser credential stores or beaconing to unknown servers, catch what signatures miss.
• Do not treat a signature as proof of safety. Check the publisher’s reputation and history, not just that a certificate exists.
• Filter web traffic and ads. DNS filtering and ad blocking reduce exposure to malvertising and newly registered lookalike domains.
• Offer sanctioned AI tools. Employees looking for AI productivity help will find it somewhere. Providing approved options reduces the pull toward unknown downloads; see our article on shadow AI.
• Protect browser-stored credentials. Use a managed password manager and phishing-resistant MFA, so stolen browser data is less useful.
• Train on the lure. Teach staff that “free AI tool” downloads from ads or unfamiliar sites are a common infection route, and give them an easy way to request software.

The trade-off is convenience. Locking down installation creates requests for IT and occasional frustration. A fast, friendly approval process for legitimate tools is what makes the restriction sustainable.

If you suspect an infection

Search your software inventory and endpoint logs for the application names above and for unfamiliar productivity tools installed from outside approved sources. Isolate affected machines, preserve evidence, and assume browser-stored passwords and session cookies on those machines are compromised: reset credentials and revoke active sessions for the users involved. Because EvilAI acts as a stager, also look for additional payloads delivered after the initial infection. If you lack the tools or staff to investigate confidently, bring in an incident response partner early; a quick, well-documented response also helps with any insurance claim or notification obligations.

Frequently asked questions

Is EvilAI malware that uses AI to think for itself?

No. The research describes malware whose code appears to have been produced with AI help and which is disguised as AI and productivity tools. Its behavior is conventional stager and data-theft activity, not autonomous reasoning.

Would antivirus have caught it?

Signature-based antivirus struggled, especially early on, because the code was new and the installers were signed. Behavior-based endpoint detection is far better suited to this type of threat.

Are only large companies targeted?

No. Distribution through ads and search results reaches anyone looking for a free tool, including employees of small businesses.

Strengthen your endpoint defenses

Delana Technologies helps organizations control software installation, deploy behavior-based endpoint protection and respond to suspected infections through our cybersecurity and compliance services. To review your exposure, call 239.414.5126 or contact us.

---

Sources: Trend Micro Research, “EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks” (September 2025); The Hacker News, “EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations” (September 2025); Anthropic threat intelligence report on detecting and countering misuse (August 2025).