Fake GPU utilities spread through search and AI recommendations

Microsoft’s 26 May investigation describes a cryptojacking campaign impersonating utilities such as hardware monitors, driver tools and PDF software. Malicious download sites appeared through poisoned search results and AI-chatbot interactions. Researchers assessed that the campaign favoured machines with more valuable graphics-processing capacity.

The reported chain also abused ScreenConnect to maintain remote access. That creates a broader exposure than unwanted electricity use or reduced GPU performance alone. The case makes the download source a separate verification step from the quality of the recommendation. A familiar product name in a search result or assistant answer does not show that the linked installer came from the developer. Microsoft’s report supplies the campaign observations and assessment.