Researchers detail how hackers use hijacked Facebook pages to push ads promoting fake AI services to spread malware; a fake Midjourney page had 1.2M followers
don't fall for this LinkedIn: Oana Bistriceanu : Over the past year, Bitdefender Labs has seen a motley crew of AI-powered illicit operations conducted by threat actors over social media. …
Context & Ripple Effects
This campaign extends a documented pattern in which compromised Facebook identities are repurposed as distribution infrastructure: a 2023 campaign used fake and compromised accounts to send more than 100,000 weekly Messenger phishing messages aimed at business accounts. Earlier reporting also described verified Meta accounts impersonating the company to distribute dubious downloads.
What is newer here is the use of AI-service branding and an established-looking Midjourney page with 1.2 million followers. That combines account takeover, paid reach and demand for AI tools into a more credible malware-delivery path.
First-order effects
- Facebook users who encounter promoted offers from the hijacked page face malware risk while believing they are engaging with a familiar AI brand.
- Facebook must investigate compromised pages and malicious ad placements; Midjourney’s name is exposed to abuse despite not being identified as the operator of the page.
Second-order effects
- Ad review and account-security systems face pressure to assess page provenance, not just an individual ad’s creative, because compromised high-follower pages can lend campaigns immediate credibility.
- Legitimate AI-service providers may need to make official download and account channels easier to verify as attackers use AI demand as a lure.
Third-order effects
- If this pattern persists, social platforms’ advertising systems become a broader AI-enabled enforcement surface, where trust in established accounts is as important as detecting malicious content.
- The durable shift is toward attacks that buy or inherit distribution rather than building it from scratch, raising the value of rapid account-recovery and provenance controls.
The trend: AI-tool demand is becoming a distribution advantage for social-engineering campaigns, especially when attackers can pair it with compromised accounts and paid promotion.