Cybersecurity researchers noted a surge in campaigns that masquerade as popular AI tools to breach corporate environments, according to ANY.RUN (ANY.RUN's Cybersecurity Blog). Between April 15 and October 5, 2026, the firm logged 1,258 public sandbox analyses linked to counterfeit AI software lures. The operations aim to drop infostealers, remote‑access trojans, and hijack active enterprise sessions (Dark Reading).
Most incidents copy the most recognizable generative‑AI platforms. Impersonations of Anthropic's Claude accounted for 601 analyses—48 percent of the dataset—while lures posing as OpenAI's ChatGPT and Codex made up 418 analyses, or 33 percent. Threat actors also deployed fake versions of GitHub Copilot and Google Gemini to reach corporate users.
Social‑engineering tricks that force victims to run malicious steps dominate the attack surface. Fake command‑line interface installers appeared in 27 percent of analyses; traditional ClickFix schemes involving bogus download sites showed up in 17 percent. Roughly 45 percent of cases instructed users to paste a command directly into their terminal.
Push Security’s research shows attackers hijack legitimate AI domains to slip past standard security filters (Push Security). They exploit shared conversation features on chatgpt.com and claude.ai to host malicious installation instructions that evade initial URL reputation checks. Victims landing on these trusted sites are prompted to copy and paste terminal commands that download infostealers such as AMOS.
Adversaries spread these lures through sponsored malvertising on search engines, SEO poisoning, and replicated documentation on trusted hosting services like Cloudflare Pages, GitLab Pages, and GitHub. While campaigns aimed at marketers use ads and search tampering, fake CLI tools are crafted to mislead developers searching for automation tools.
The United States tops the list of targets, leading analyses of fake Claude download sites and ChatGPT‑related infection chains. In ANY.RUN’s global telemetry, the United States recorded the second‑largest volume of user submissions, behind India.
Security teams should watch for suspicious terminal executions and block untrusted external scripts, as the primary vector hinges on victims running unauthorized commands or submitting credentials to fake interfaces. They must also look beyond simple domain‑reputation filters, since abuse of genuine subdomains hosted by AI providers bypasses static web boundaries.
The heavy focus on Claude and ChatGPT impersonation suggests that threat actors are systematically adapting traditional credential harvesting into developer‑centric social engineering. Because developers routinely paste terminal commands from documentation, attackers appear likely to continue weaponizing shared platform URLs and CLI tooling to bypass conventional browser protections.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation