Science & Tech · Cybersecurity · 2 hrs ago
Fake AI tools are being used to spread malware
Researchers linked 1,258 analyses to fake AI campaigns over six months, from April to October 2026.
The campaigns impersonated popular tools, most often Claude, followed by ChatGPT and Codex.
Fake download pages, ads and search results directed people to counterfeit installers or sign-in pages.
In many attacks, employees were tricked into running commands or entering credentials, turning a routine installation into a security risk.
The malware can steal source code, access keys, browser sessions and business account details, potentially disrupting development or marketing work.
The analysis count does not confirm how many devices were infected, but researchers say the campaigns reached many users.
Researchers expect the fake AI lures to grow, so companies will need to watch for suspicious installation instructions and credential requests.
Attackers are using fake AI tools that impersonate brands such as Claude and ChatGPT to spread malware and steal credentials.
ANY.RUN linked 1,258 sandbox analyses to fake AI campaigns between April and October 2026.
The campaigns use tactics including malicious ads, fake download pages and instructions that persuade employees to run commands.
The attacks can expose source code, account credentials, cloud keys and business sessions.
US businesses accounted for 16% of country-attributed targets in ANY.RUN’s data.
- Who
- Attackers impersonating AI services such as Claude, ChatGPT and GitHub Copilot.
- What
- Fake AI campaigns distribute malware, steal browser sessions and compromise business accounts.
- When
- Between April and October 2026, according to ANY.RUN data.
- Where
- Targets included companies worldwide; US businesses accounted for 16% of country-attributed targets.
- Why
- The campaigns trick employees into running malicious commands, installing compromised applications or submitting credentials.
This story does not have two clearly opposing sides.
ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns.
The Hacker News published an article on fake AI attacks targeting businesses.
Dark Reading published a report on fake AI attacks and risks to developers.
- Analyses
- 1,258 public sandbox analyses linked to fake AI campaigns
- Period
- April to October 2026
- Most impersonated brand
- Claude accounted for 60% of analyses
- Other impersonated brands
- ChatGPT and Codex accounted for 33% of analyses
- US targets
- 16% of country-attributed targets
3 sources
What people are saying
This number alone shows how widespread the problem has become, especially considering that security teams from over 16,000 companies worldwide use Any.Run to investigate suspicious activity
While it's impossible to confirm the exact number of infections, the data suggests these campaigns reached a significant number of users.
We expect fake AI lures to become even more common as new AI tools continue to launch and public interest remains high