printer friendly version

Stay safe while using AI assistants

The new DeepSeek AI assistant has attracted a lot of attention, but Kaspersky experts have also detected scam activity related to it.

Due to high numbers of new users and an alleged cyberattack on DeepSeek, there are glitches in the registration process on its app and website – many registrations cannot come through. Cybercriminals can use this situation to steal the credentials of users through fake DeepSeek web pages.

Attackers can collect users’ emails and passwords through such fake registration pages. These can be exploited to access users’ accounts – on DeepSeek or in other services (if the password is the same for multiple accounts).

There were also several new crypto tokens based on the DeepSeek hype available for sale. They are not officially tied to the DeepSeek brand; hence, their capitalisation is speculative.

Such scam schemes, like creating phishing emails, are quite widespread with popular AI models, and it’s important to recognise that cybercriminals will inevitably seek to exploit such tools for malicious purposes.

“What stands out in the case of DeepSeek is its open-source nature. While open-source frameworks foster transparency, collaboration, and innovation, they also introduce significant security and ethical risks. When using an open-source tool, you can’t always be sure how your data is being handled, especially if someone else has deployed it,” comments Leonid Bezvershenko, Security Researcher, Kaspersky GReAT.

“Exploitation of open-source software was a major trend in the threat landscape last year, with cybercriminals running complex campaigns to embed malware. In 2024, Kaspersky’s open-source scanner detected over 12 000 malicious packages in open repositories. Without centralised oversight, threat actors can start creating compromised versions of software or introduce backdoors under the guise of tools for using the API of DeepSeek, presenting serious risks to users and organisations.”

Kaspersky recommends the following tips to stay protected:

• Carefully check the addresses of pages asking for account credentials. Do not enter your password if there’s even the slightest suspicion that a website is fake.

• Make sure all your passwords are both strong and unique. It’s best to use a password manager to generate and store them.

• Always use two-factor authentication wherever possible.

• Use reliable protection for all your devices, desktop and mobile, to be protected from credential loss and malware.

Share this article:

Further reading: