Bogus ‘DeepSeek’ AI Installers Are Infecting Devices with Malware, Research Finds

In a digital landscape hungry for the next big thing in Artificial Intelligence, a new contender called DeepSeek recently burst onto the scene and has quickly gained traction for its advanced language models.

Positioned as a low-cost alternative to industry giants like OpenAI and Meta, DeepSeek has drawn attention for its rapid growth, affordability, and potential to reshape the AI landscape.  

Unfortunately, a recent investigation by McAfee Labs found that the same hype is now fueling a barrage of malware attacks disguised as DeepSeek software and updates.

Here’s a breakdown of those research findings:

How the Attacks Unfold

It starts with a user searching online to find DeepSeek to use for themselves. Innocent enough. The problem comes from malicious results that promise access to DeepSeek, but actually steal data and infect computers.

McAfee Labs’ blog post pulls back the curtain on three main deception methods:

1. Fake “DeepSeek” Installers

• Users find files named DeepSeek-R1.Leaked.Version.exe or DeepSeek-VL2.Developer.Edition.exe that appear legitimate.
• Once a computer runs the code in that file, it connects to hostile servers and downloads a cocktail of malware—ranging from stealthy keyloggers and password stealers to coin miners that can quietly siphon your computer’s resources.
  • A keylogger is a type of malicious software designed to record every keystroke you make on your keyboard. That includes passwords, credit card numbers, email drafts, and everyday messages. The goal is to capture sensitive information without you realizing it’s happening. Cybercriminals then use or sell that stolen data, potentially leading to account takeovers, identity theft, or financial fraud.
  • A coin miner (also known as a cryptominer) is software that uses your computer’s processing power (CPU and sometimes GPU) to “mine” cryptocurrency, like Monero or Bitcoin. Mining is typically legitimate when you choose to do it yourself, but criminals sneak coin miners onto victims’ machines so they can profit at your expense. You’ll often see your computer slow down, overheat, or experience performance drops, because a portion of its resources are secretly diverted to generating cryptocurrency for the attacker’s benefit.

2. Unrelated Third-Party Software Installs

• Some “DeepSeek installers” turn out to be disguised versions of other applications, like free audio editors or system tools.
• Victims think they’re getting the latest DeepSeek AI tool but end up with unwanted—and potentially risky—software.

3. Fake Captcha Pages

• Fraudulent websites display official-looking “partnership” or “captcha verification” screens.
• Users are tricked into pasting secret commands into the Windows Run dialog, disabling antivirus programs and installing malware like Vidar Infostealer, which can swipe browser data and digital wallet credentials.

How to Stay Safe

McAfee’s experts underscore the importance of careful online habits and shares best practices to keep threats at bay:

1. Verify Before You Download: Stick to official DeepSeek or AI tool websites. If you’re not sure, do more research or consult well-known developer forums.
2. Check the URL: Criminals mimic legitimate domains or slightly alter them (like adding extra letters) to fool you. A single typo can be a warning sign.
3. Never Paste Mystery Commands: If a site tells you to press Windows + R and paste something you can’t see in full, don’t do it.
4. Keep Security Software Updated: A strong antivirus that’s regularly updated stands guard against the latest threats.
5. Patch Everything: Whether it’s your operating system, browser, or everyday apps, installing security updates promptly reduces vulnerabilities.
6. Stay Alert to Performance Issues: Unexplained slowdowns or hot-running devices could signal hidden mining operations or other malicious activity.
7. Use Tools Like McAfee +: Online protection tools like McAfee+ will alert you to suspicious websites, links, and downloads and help guard your devices against threats.

McAfee Labs’ findings reveal just how adaptable—and opportunistic—cybercriminals can be when fresh digital gold rushes emerge. By following basic security practices and staying skeptical about anything that seems too good to be true, you can explore new AI frontiers without handing over the keys to your device.

When in doubt, stop, do your due diligence, and only download from verified sources. Your curiosity about the latest tech trends shouldn’t come at the cost of your personal data or system security.

READ OUR FULL RESEARCH HERE

Introducing McAfee+

Identity theft protection and privacy for your digital life

Download McAfee+ Now