# Fake AI Tool Campaigns Targeting Enterprises (ChatGPT, Claude, Copilot, Gemini, GitHub Copilot CLI lures)

> ANY.RUN analysis of 1,258 public sandbox submissions (Apr 15 - Oct 5, 2026) ties a family of campaigns to counterfeit AI sites, fake CLI installers (InstallFix), ClickFix command-paste lures, fake sign-in windows and trojanized desktop apps that steal browser credentials, cookies and session tokens. Claude is the most impersonated brand, followed by ChatGPT/Codex, and the technology sector was hit in all seven tracked campaigns.

- **Published:** 2026-10-21T22:49:22Z
- **Last reviewed:** 2026-10-21T22:49:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4072
- **ID:** TL-2026-4072
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ANY.RUN, as relayed by Cyber Security News (2026-10-21) and several secondary outlets, examined 1,258 public sandbox submissions recorded between 2026-04-15 and 2026-10-05 and grouped them into seven campaigns that abuse the popularity of AI tools. Reported lure brands are Claude (about 60% of analyses; 601 records in one secondary tally), ChatGPT/Codex (about 33%; 418 records), Microsoft Copilot, GitHub Copilot CLI, Google Gemini and Perplexity. Activity peaked in May 2026 (358 analyses) and ran at 108-151 analyses per month from June to September.

The common trait is that the employee performs the decisive step. Lures arrive through sponsored search listings, SEO poisoning, malicious ads and public AI conversations, and lead to fraudulent landing pages hosted on GitHub Pages, GitLab Pages, Cloudflare Pages and Google Sites. Reported delivery patterns are: fake CLI installers (InstallFix, about 27% of analyses) in which a cloned installation page swaps the legitimate one-liner for a malicious one; classic ClickFix flows that begin with a fake download page (about 17%); trojanized desktop installers that run a legitimate AI application while collecting browser data; and fake sign-in windows (for example a fraudulent Google sign-in presented in fake 'Claude Ads' lures aimed at marketing staff). Terminal command execution accounted for 341 instances and rogue download sites for 220 in one secondary breakdown. Developers are lured with fake GitHub Copilot CLI install pages that put source code, cloud credentials and AI API keys at risk.

On Windows, the InstallFix command documented by Push Security and Malwarebytes spawns cmd.exe and invokes mshta.exe against a remote URL to run the payload (Amatera infostealer). On macOS, the pasted one-liner pulls a base64-obfuscated second-stage script that downloads a binary, strips file attributes (quarantine) and sets it executable. ANY.RUN also observed in early June 2026 a ClickFix campaign mimicking Claude Code and OpenAI Codex with pages on sites.google.com that uses hidden characters in commands so a second command runs in the foreground and downloads an infostealer targeting API keys, browser-saved passwords and crypto wallets. Stolen passwords, cookies and authentication tokens enable session hijacking and access to cloud dashboards, ad accounts and billing without needing the password.

Top affected sectors in the ANY.RUN data: technology (7 of 7 campaigns), telecommunications (6), education (5), consulting (5), manufacturing, healthcare, government and finance (4 each). Country-tagged submissions came mainly from India (about 20%) and the United States (about 16%). The primary ANY.RUN-derived article names no malware families, IOCs, CVEs or actors. The network IOCs and malware families recorded here come from separate vendor reporting on AI-brand impersonation (Sophos, Cloud Security Alliance, Push Security/Malwarebytes) and are related-campaign indicators, not confirmed members of the seven ANY.RUN clusters. No attribution is made.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.006 Web Services
- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1218.005 Mshta
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.002 GUI Input Capture

## Sources

- [The AI Adoption Blind Spot: How Fake AI Tools Put Enterprises at Risk](https://cybersecuritynews.com/the-ai-adoption-blind-spot-how-fake-ai-tools-put-enterprises-at-risk/)
- [Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk (Dark Reading)](https://darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk)
- [Fake Claude and ChatGPT Applications Target Corporate Systems to Hijack Active Sessions](https://the420.in/?p=98684)
- [Fake Claude Code install pages highlight rise of InstallFix attacks (Help Net Security, Push Security research)](https://www.helpnetsecurity.com/2026/03/09/fake-claude-code-install-pages-installfix-attacks/)
- [Fake Claude Code install pages hit Windows and Mac users with infostealers (Malwarebytes)](https://www.malwarebytes.com/blog/news/2026/03/fake-claude-code-install-pages-hit-windows-and-mac-users-with-infostealers)
- [Fake AI, Real Malware: Attackers Impersonating AI Brands (Sophos)](https://www.sophos.com/blog/fake-ai-real-malware-attackers-impersonating-ai-brands)
- [AI Developer Tool Impersonation: Typosquatting, Fake Install Guides, and InfoStealer Delivery (CSA Labs)](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-tool-impersonation-installfix-typosquat/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4072