Threat reportMalwareTL-2026-4072
Fake AI Tool Campaigns Targeting Enterprises (ChatGPT, Claude, Copilot, Gemini, GitHub Copilot CLI lures)
Fake AI Tool Campaigns Targeting Enterprises (ChatGPT (TL-2026-4072), also tracked as InstallFix AI-brand impersonation, is a medium-severity malware campaign, first published 2026-10-21. It has no confirmed attribution, affects Microsoft Windows (endpoints running user-installed AI tools), maps to 13 MITRE ATT&CK techniques (T1027, T1036, T1056.002), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-4072
- Threat ID
- TL-2026-4072
- Also known as
- InstallFix AI-brand impersonation, Fake AI tool campaigns
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, telecoms, education, consulting, manufacturing, health, government administration, finance
- Target regions
- india, united states of america, Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Fake AI Tool Campaigns Targeting Enterprises (ChatGPT
Malware and tooling: AMOS, Amatera Stealer, Lumma Stealer - S1213, MacSync Infostealer, Noodlophile Stealer, mshta.exe
How Fake AI Tool Campaigns Targeting Enterprises (ChatGPT works
ANY.RUN analysis of 1,258 public sandbox submissions (Apr 15 - Oct 5, 2026) ties a family of campaigns to counterfeit AI sites, fake CLI installers (InstallFix), ClickFix command-paste lures, fake sign-in windows and trojanized desktop apps that steal browser credentials, cookies and session tokens. Claude is the most impersonated brand, followed by ChatGPT/Codex, and the technology sector was hit in all seven tracked campaigns.
ANY.RUN, as relayed by Cyber Security News (2026-10-21) and several secondary outlets, examined 1,258 public sandbox submissions recorded between 2026-04-15 and 2026-10-05 and grouped them into seven campaigns that abuse the popularity of AI tools. Reported lure brands are Claude (about 60% of analyses; 601 records in one secondary tally), ChatGPT/Codex (about 33%; 418 records), Microsoft Copilot, GitHub Copilot CLI, Google Gemini and Perplexity. Activity peaked in May 2026 (358 analyses) and ran at 108-151 analyses per month from June to September.
The common trait is that the employee performs the decisive step. Lures arrive through sponsored search listings, SEO poisoning, malicious ads and public AI conversations, and lead to fraudulent landing pages hosted on GitHub Pages, GitLab Pages, Cloudflare Pages and Google Sites. Reported delivery patterns are: fake CLI installers (InstallFix, about 27% of analyses) in which a cloned installation page swaps the legitimate one-liner for a malicious one; classic ClickFix flows that begin with a fake download page (about 17%); trojanized desktop installers that run a legitimate AI application while collecting browser data; and fake sign-in windows (for example a fraudulent Google sign-in presented in fake 'Claude Ads' lures aimed at marketing staff). Terminal command execution accounted for 341 instances and rogue download sites for 220 in one secondary breakdown. Developers are lured with fake GitHub Copilot CLI install pages that put source code, cloud credentials and AI API keys at risk.
On Windows, the InstallFix command documented by Push Security and Malwarebytes spawns cmd.exe and invokes mshta.exe against a remote URL to run the payload (Amatera infostealer). On macOS, the pasted one-liner pulls a base64-obfuscated second-stage script that downloads a binary, strips file attributes (quarantine) and sets it executable. ANY.RUN also observed in early June 2026 a ClickFix campaign mimicking Claude Code and OpenAI Codex with pages on sites.google.com that uses hidden characters in commands so a second command runs in the foreground and downloads an infostealer targeting API keys, browser-saved passwords and crypto wallets. Stolen passwords, cookies and authentication tokens enable session hijacking and access to cloud dashboards, ad accounts and billing without needing the password.
Top affected sectors in the ANY.RUN data: technology (7 of 7 campaigns), telecommunications (6), education (5), consulting (5), manufacturing, healthcare, government and finance (4 each). Country-tagged submissions came mainly from India (about 20%) and the United States (about 16%). The primary ANY.RUN-derived article names no malware families, IOCs, CVEs or actors. The network IOCs and malware families recorded here come from separate vendor reporting on AI-brand impersonation (Sophos, Cloud Security Alliance, Push Security/Malwarebytes) and are related-campaign indicators, not confirmed members of the seven ANY.RUN clusters. No attribution is made.
MITRE ATT&CK techniques used in TL-2026-4072
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta
Credential Access
T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Execution
T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Resource Development
Affected products and versions in Fake AI Tool Campaigns Targeting Enterprises (ChatGPT
- Microsoft — Windows (endpoints running user-installed AI tools)
Vulnerable versions: user-execution based; not version specific - Apple — macOS (Terminal command-paste lures)
Vulnerable versions: user-execution based; not version specific - Anthropic / OpenAI / Microsoft / Google — Brands impersonated: Claude, Claude Code, ChatGPT, Codex, Copilot, GitHub Copilot CLI, Gemini (no vendor product vulnerability)
Remediation for Fake AI Tool Campaigns Targeting Enterprises (ChatGPT
Immediate actions
- Block or alert on egress to the related domains listed in the IOC set and hunt proxy/DNS logs for them
- Alert on cmd.exe spawning mshta.exe with a remote URL, and on terminal one-liners that decode base64 and pipe to a shell
- Revoke and rotate browser-saved credentials, session cookies, cloud and AI API keys on any device that ran a pasted install command or untrusted AI installer
Workarounds
- Restrict mshta.exe execution via application control where not required
- Block sponsored-result and newly registered lookalike domains for AI brands at the secure web gateway
Longer-term hardening
- Allow-list approved AI tools and distribute them through managed software channels rather than search-engine results
- Train staff, developers and marketing users that official AI CLI install commands must be copied only from vendor-owned domains, and never to paste commands from web pages into a terminal or Run dialog without review
- Enforce phishing-resistant MFA and short session lifetimes with token-binding or conditional access to limit stolen-cookie replay
- Monitor ad accounts and billing access for anomalous sign-ins
Timeline of Fake AI Tool Campaigns Targeting Enterprises (ChatGPT
- Push Security research on InstallFix fake Claude Code install pages delivering Amatera stealer is reported by Help Net Security; Malwarebytes covers the same campaign the same month
- Start of the ANY.RUN observation window of 1,258 public sandbox analyses linked to fake AI tool campaigns
- Activity peaks in May 2026 with 358 analyses (date set to month end; source gives month only); June-September then runs at 108-151 analyses per month
- In early June (month-level date) ANY.RUN spots a ClickFix campaign mimicking Claude Code and OpenAI Codex on sites.google.com that uses hidden characters to run a second command and download an infostealer
- End of the ANY.RUN observation window; seven campaigns identified, with technology targeted in all seven
- Cyber Security News publishes the ANY.RUN findings on fake AI tools putting enterprises at risk
Sources cited for Fake AI Tool Campaigns Targeting Enterprises (ChatGPT
- The AI Adoption Blind Spot: How Fake AI Tools Put Enterprises at Risk
- Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk (Dark Reading)
- Fake Claude and ChatGPT Applications Target Corporate Systems to Hijack Active Sessions
- Fake Claude Code install pages highlight rise of InstallFix attacks (Help Net Security, Push Security research)
- Fake Claude Code install pages hit Windows and Mac users with infostealers (Malwarebytes)
- Fake AI, Real Malware: Attackers Impersonating AI Brands (Sophos)
- AI Developer Tool Impersonation: Typosquatting, Fake Install Guides, and InfoStealer Delivery (CSA Labs)
Detection coverage for TL-2026-4072
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4072 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.