Ledger / 29 Aug 2025
EvilAI: fake productivity apps built with AI-generated code
Strong
Trend Micro attributes AI-generated code from artifacts; no model named.
Operators distributed working but trojanized apps with valid certificates, with code that Trend says was AI-generated and hard for static scanners to flag. Later vendor reporting says activity continued into 2026.
“Combining AI-generated code and social engineering, EvilAI operators are executing a rapidly expanding campaign”Trend Micro
Sources
- EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching AttacksTrend Micro · 10 Sep 2025 · primary source
- Date
- 29 Aug 2025
- Disclosed
- 10 Sep 2025
- Actor
- EvilAI operators (criminal), as attributed by Trend Micro
- Targets
- Organizations worldwide; manufacturing, government, healthcare
- What the AI did
- Malware dev, Evasion
- Model
- unspecified AI tools
- Model family
- Unspecified
- Model basis
- unknown
- Autonomy
- assist
- Outcome
- Signed trojanized apps stole browser data and acted as a stager; 100+ incidents in first week of telemetry.