Microsoft said on May 26, 2026 [1], that a GPU-focused cryptojacking campaign is targeting users through SEO-poisoned search results and AI chatbots.

This campaign represents a shift in how malware is distributed, leveraging the perceived trust of AI-generated recommendations to trick users into installing malicious software. By targeting high-performance hardware, attackers can maximize the efficiency of cryptocurrency mining at the victim's expense.

According to the company, the malware is disguised as legitimate PC utilities [1]. These include popular tools such as HWMonitor, CrystalDiskInfo, ScreenConnect, and Microsoft .NET utilities [1]. The campaign specifically targets gamers and owners of high-end PCs, as these systems typically possess the powerful graphics processing units required for profitable mining [1].

Threat actors are using search engine optimization poisoning to ensure their malicious links appear at the top of search results [1]. Furthermore, the campaign has expanded to include AI-chatbot platforms, where the bots may recommend these poisoned links to users seeking technical tools [1]. Once installed, the malware hijacks the GPU resources to mine cryptocurrency, a process known as cryptojacking [1].

Microsoft said the campaign uses these deceptive methods to bypass traditional user caution. Because the software masquerades as essential system utilities, users are more likely to grant the programs the permissions necessary to execute the mining payload [1].

Users are encouraged to download software only from official vendor websites and to remain skeptical of tool recommendations provided by AI chatbots or unverified search results [1].

“The campaign specifically targets gamers and owners of high-end PCs.”

The use of AI chatbots as a delivery vector for malware indicates that threat actors are adapting to the way users discover information. As people increasingly rely on AI for technical recommendations, the 'trust gap' created by these interfaces allows attackers to bypass the skepticism typically applied to standard web advertisements or suspicious emails.