Attackers are using counterfeit AI products to push malware, steal browser sessions and compromise business accounts, according to research from ANY.RUN. The company linked 1,258 public sandbox analyses to fake-AI campaigns between April and October 2026, with the United States accounting for 16% of targets whose country could be determined.
The lures impersonated Claude, ChatGPT, GitHub Copilot, Gemini and other widely recognized services. Researchers said the campaigns appeared in sponsored search results, shared AI conversations and counterfeit download sites, where victims were encouraged to install software or follow instructions presented as routine setup steps. Some pages also redirected users to fraudulent authentication screens designed to capture credentials.
One observed Claude-themed infection chain began when a victim clicked a Windows download button on a fake website. The page copied a command to the clipboard and instructed the user to run it with PowerShell. Instead of installing an AI application, the command launched mshta.exe, retrieved a malicious HTA file and triggered an encoded PowerShell chain. Other activity included scheduled tasks that launched browsers as part of browser-session theft.
The technique is significant because it combines familiar brands with legitimate Windows utilities and delayed, multi-stage execution. Rotating domains, hosting providers and AI branding can quickly invalidate blocklists, while the user’s deliberate interaction may make the activity resemble an authorized installation. The supplied research did not attribute the campaigns to a named threat actor and did not identify a specific CVE, public exploit or vendor patch associated with the activity.
For managed security service providers, the campaigns create a scaling problem: similar incidents can recur across customers even as the visible indicators change. That can consume Tier 1 analyst time, increase escalations and delay response under customer service-level agreements. The more durable detection opportunities are behavioral, including suspicious PowerShell commands, unexpected mshta.exe execution, encoded downloads and browser launches from scheduled tasks.
MSSPs should therefore treat fake-AI alerts as an investigation and correlation problem rather than relying only on domain reputation. Analysts can safely reproduce suspicious installation flows in an isolated sandbox, capture process and network activity, and feed validated indicators into SIEM and EDR workflows. Findings from one customer should also be hunted across other environments, while identity teams should revoke exposed sessions and require phishing-resistant authentication when credentials or browser tokens may have been stolen. ANY.RUN’s campaign report, published by The Hacker News, recommends combining behavioral investigation with threat intelligence to reduce repetitive triage as the lures evolve.
