# Sophos X-Ops: Attackers Impersonate Claude, ChatGPT, Copilot and Perplexity to Distribute Infostealers, Backdoors and Malicious Browser Extensions

> Sophos X-Ops reviewed 12 months of MDR case data (July 2025-June 2026) and confirmed 38 incidents of malicious activity impersonating popular AI brands, 30 of them software impersonation and 26 abusing the Claude brand specifically. Attackers use a ClickFix variant dubbed 'InstallFix', trojanized installers/.msixbundle packages, and a malicious Chrome Web Store extension impersonating Perplexity to deliver infostealers (LummaStealer), a previously undocumented DLL-sideloaded backdoor ('Beagle'), and a Rust-based Slack-C2 RAT whose GitHub development history shows commits from a Claude coding-agent account.

- **Published:** 2026-08-23T00:00:00Z
- **Last reviewed:** 2026-08-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2120
- **ID:** TL-2026-2120
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

Between 2 July 2025 and 29 June 2026, Sophos X-Ops reviewed 86 MDR cases tagged for AI involvement and confirmed 38 as genuinely adversarial. Of those, 35 targeted AI brands/ecosystem and 30 were direct software impersonation, with Claude the most abused lure (26 of 38 cases) ahead of ChatGPT, Microsoft Copilot, and Perplexity.

The dominant delivery technique is a ClickFix variant Sophos calls 'InstallFix': malvertising and SEO-poisoned search results steer victims to typosquatted sites that present a polished, fake step-by-step 'installation guide' ending in a copy-pasted obfuscated command. In one documented chain, a fake Claude site had victims run an mshta one-liner pulling a payload from download-version[.]1-9-18[.]com; the payload was a Windows app package named 'claude' or 'claude.msixbundle', followed by an `irm <url> | iex` one-liner that executed in memory and attempted process hollowing against the browser. Other InstallFix variants used trojanized 'Claude Setup.zip' archives staging a malicious libcef.dll, and a repackaged claude.exe acting as a loader; a related fake-CAPTCHA ClickFix flow distributed LummaStealer.

A separate, previously-undocumented backdoor named 'Beagle' was distributed from a cloned Claude site (claude-pro.com, live since ~March 2026, hosted on Alibaba Cloud behind Cloudflare) offering a fictitious 'Claude-Pro Relay' as a 505 MB ZIP. The archive's MSI installer drops a signed G DATA antivirus updater (renamed NOVupdate.exe), an encrypted data file, and a malicious avk.dll into the Windows startup folder; when the legitimate, signed updater runs it side-loads avk.dll in place of its real library, which reverses an XOR-encoded blob, runs shellcode, and launches an in-memory DonutLoader that ultimately deploys Beagle. Beagle supports eight commands (CMD/PowerShell execution, file upload/download, directory listing/creation/deletion, file rename, self-removal) and beacons to license[.]claude-pro[.]com over TCP/443 or UDP/8080 with a hardcoded AES key; a March 2026 variant instead deployed AdaptixC2. Sophos notes structural similarity to PlugX-style loader chains without formally attributing the cluster.

On the extension front, Sophos found a fake Perplexity browser extension published on the Chrome Web Store — with a 4.7-star rating across 67 reviews and 10,000+ installs — that hijacked searches, redirected traffic through perplexity-ai[.]online, displayed a Tilda-hosted landing page (extension.tilda.ws/perplexityai) post-install, and exfiltrated real-time browsing telemetry to attacker infrastructure. A second extension marketed as an 'AI Sidebar with DeepSeek, ChatGPT, Claude' functioned the same way, beaconing stolen data to its own C2.

The most novel finding is a custom Rust-based RAT discovered during a financial-services intrusion. Its source was recovered from a public GitHub repository with visible commit history showing two contributors: a human threat-actor account and a 'claude' AI coding-agent account (built on an agentic skills framework), with the config internally renamed from 'rat-agent' to 'svc' across the development history. The RAT polls a Slack channel for host-tagged operator commands and supports remote command execution, reverse shell, file download, DPAPI-encrypted configuration retrieval, and scheduled-task-based persistence; development spanned several days of iterative feature/encryption/hardening commits.

Sophos also flags — as a separate, lower-confidence finding from the same 38-incident review — a SonicWall SMA1000 ransomware intrusion (via the actively-exploited CVE-2026-15409/CVE-2026-15410 SSRF+code-injection chain) where PowerShell used for internal reconnaissance carried unusually verbose, templated, English-narrated comments and, in one script, Mandarin-language comments — a pattern consistent with, though not conclusive proof of, LLM-generated tooling; the leaked internal chats of the unrelated 'Gentlemen' ransomware group separately show the group promoting an uncensored Qwen3.5 build to affiliates in April 2026. Sophos' core recommendation across all clusters is unchanged: install AI tooling only from confirmed, official vendor domains, and treat 'paste this command to fix/install' prompts as a red flag.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1583.008 Acquire Infrastructure: Malvertising
- T1608.006 Stage Capabilities: SEO Poisoning
- T1204.004 User Execution: Malicious Copy and Paste
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1218.005 System Binary Proxy Execution: Mshta
- T1055.012 Process Injection: Process Hollowing
- T1027 Obfuscated Files or Information
- T1574.001 DLL
- T1553.002 Subvert Trust Controls: Code Signing
- T1140 Deobfuscate/Decode Files or Information
- T1176 Software Extensions
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1572 Protocol Tunneling
- T1567 Exfiltration Over Web Service

## Sources

- [Fake AI, real malware: Attackers impersonating AI brands](https://www.sophos.com/en-us/blog/fake-ai-real-malware-attackers-impersonating-ai-brands)
- [Attackers impersonate popular AI brands to spread malware](https://www.helpnetsecurity.com/2026/08/21/ai-brand-impersonation-malware-malware-research/)
- [Donuts and Beagles: Fake Claude site spreads backdoor](https://www.sophos.com/en-us/blog/donuts-and-beagles-fake-claude-site-spreads-backdoor)
- [Fake Claude AI Site Drops Beagle Backdoor on Windows Users](https://www.infosecurity-magazine.com/news/fake-claude-site-beagle-backdoor/)
- [Fake Claude AI website delivers new 'Beagle' Windows malware](https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/)
- [Fake Claude AI Website Delivers New Beagle Windows Backdoor via Malvertising](https://securityboulevard.com/2026/05/fake-claude-ai-website-delivers-new-beagle-windows-backdoor-via-malvertising/)
- [Hackers Impersonate Claude, ChatGPT and Copilot to Deliver Infostealers and Backdoors](https://gbhackers.com/ai-brands-malware/)
- [Hackers Use PlugX-Like DLL Sideloading Chain in Fake Claude Malware Campaign](https://cybersecuritynews.com/hackers-use-plugx-like-dll-sideloading-chain/)
- [A double-edged bleeding edge: Classifying AI threats](https://www.sophos.com/en-us/blog/a-double-edged-bleeding-edge-classifying-ai-threats)
- [Sophos X-Ops AI 2025-2026 Campaign IOCs](https://github.com/sophoslabs/IoCs/blob/master/AI_2025-2026_IOCs.csv)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2120