Fake AI Tools Are Now A Sustained Attack Campaign: What 1,258 Sandbox Sessions Show

Fake AI tools have stopped being a novelty scam and become a sustained campaign category. ANY.RUN, the malware sandbox service, published research on 14 October 2026 linking 1,258 public sandbox analyses to fake AI campaigns between 15 April and 5 October 2026, with impersonation of Claude, ChatGPT, GitHub Copilot, Gemini and other AI brands used to plant infostealers, hijack browser sessions and phish business accounts.

The numbers are not the story. The pattern is: in every chain the researchers analysed, the employee performs the decisive step. They paste an install command, run a convincing installer, or sign in to a fake window. That single user action can expose source code, cloud and AI API keys, active business sessions, ad accounts and billing access, and it walks past email-focused defences because there is no email.

This article breaks down the five attack patterns ANY.RUN documented, the brands being worn, the numbers behind them, and the practical checks for anyone whose team searches for, installs or shares AI tools. Everything comes from ANY.RUN's own research, read in full.

The shape of the campaign

The headline figures first, with the observation period attached: 1,258 public sandbox analyses between 15 April and 5 October 2026, activity peaking in May at 358 analyses, and never dropping below 100 a month since July. Claude is the most impersonated brand at 601 analyses, 48 percent, with ChatGPT and Codex together adding 418, 33 percent. Two brands account for four in five fake AI sessions.

Three structural findings matter more than the volume.

The victim runs the attack. Campaigns that make the user paste a command into the Run dialog, PowerShell or Terminal account for 561 analyses, 45 percent, split between fake CLI install pages, 341, and fake download pages using a ClickFix-style flow, 220. And that 45 percent is a lower bound, because chains starting on shared AI chats often end in a pasted command too. The employee is not the target of the attack. The employee is the execution mechanism.

Trusted platforms carry the lures. The researchers found fake pages on GitLab Pages, Cloudflare Pages, Google Sites, GitHub, and, remarkably, on claude.ai and chatgpt.com themselves, in the form of published artifacts and shared chats that live on the vendor's own domain. A company cannot block claude.ai without blocking Claude. Promotion ran through Google Ads and search results, which is how the lures entered through the front door rather than the spam folder.

The brands being worn are the brands in use. Beyond Claude and ChatGPT, the researchers documented impersonation of Codex, GitHub Copilot, Gemini, Ollama, OpenClaw, Perplexity and Manus. The United States ranked second among submitting countries overall at 16 percent of country records, and first in two major campaign groups, so American organisations are squarely in scope.

The five patterns, briefly

The research documents five chains, and their variety is the reason one defence will not cover them.

InstallFix: the install command is the malware. Fake pages copy the install documentation of Claude Code, GitHub Copilot CLI, Codex, Ollama and OpenClaw, and swap the vendor's domain in the one-liner for the attacker's. A developer who copies the command runs the attacker's script with their own permissions. Some victims reached the pages from ordinary searches: the researchers showed a Bing search for Claude Code documentation listing a lookalike domain a few lines from the official docs. One fake Ollama variant downloaded and installed the genuine Ollama installer, so the developer received a working tool while the stealer ran alongside it.

The download page that asks for PowerShell. A clone of the Claude download page, hosted across several platforms, shows step-by-step ClickFix instructions: press Win+R, open PowerShell, paste, enter. Every process in the chain is a built-in Windows binary, no file reaches the download folder, and the lure domains rotated many times while one backend host stayed constant from April to September.

The lure on the AI platform itself. A published artifact on claude.ai posing as a download page, promoted through a Google ad, instructing visitors to paste a curl command into Terminal. And a shared chat on chatgpt.com telling visitors the service was experiencing high traffic and to continue on a backup domain, with ChatGPT's own external-link warning visible while the domain name made the detour look like part of the service. Shared AI conversations and artifacts promoted the same way led to stealer payloads in most analysed sessions.

The real installer with a stager behind it. One lure site served a saved copy of the genuine Claude download page, and its button downloaded the real installer from Anthropic's own servers, running in the foreground as a decoy. Behind it, a scheduled task started a headless browser with remote debugging enabled, exporting cookies and session data to the attacker. With those cookies, the attacker can open the victim's web sessions without a password or an MFA prompt.

Ad-account phishing. Fake AI advertising invitations collecting Google account credentials from employees who manage ad budgets and billing, putting high-value business accounts at risk.

That last two patterns deserve emphasis for a specific audience. The researchers note that developers may expose source code, cloud credentials and API keys, while marketing and business teams hold advertising, billing and other high-value accounts. On a site read by marketers and creators, that is the sentence to take seriously: the fake AI tool that targets your team is more likely to arrive as an ad-account phish than as code.

The shared trait: the employee performs the decisive step

ANY.RUN's own framing, which the report repeats, is that fake AI campaigns blend into normal employee behaviour. Searching for a new AI app, following setup instructions, opening a shared chat, or connecting a business account all look routine, which is exactly why mail-gateway-focused defences miss them.

The report also identifies the structural exposure: shadow AI. Employees searching for and installing AI software outside the approved catalog make it harder for IT to distinguish legitimate software from convincing counterfeits. That is an organisational problem before it is a technical one. A team that has an approved AI tool list, a default answer to “can I install this?”, and a habit of distributing installers internally removes most of the attack surface without any new security product.

The business risks the researchers list are concrete: session theft without a password, because stolen cookies bypass MFA; developer workstation compromise, where source code, SSH keys, CI/CD tokens and cloud keys may already be reachable from the shell the victim pasted into; ad and billing account takeover; and reduced defender visibility, because these chains start in search results, use built-in binaries, and let the server choose the next stage, leaving file scanners little to inspect.

What to hunt for and what to change

The research offers SOC teams a detection angle that survives the domain rotation: the commands, backend paths, scheduled tasks and behavioural patterns stayed more stable than the frequently changing lure domains. The durable markers listed include pasted one-liner commands pulling scripts from non-vendor domains, specific download-path patterns, fake verification pages instructing the Win+R paste flow, and scheduled tasks launching headless browsers with remote debugging enabled. Those are worth adding to any monitoring you run.

For everyone else, four habits cover most of the exposure.

Distribute AI tools internally. If your team uses a coding agent or an AI app, the install command should come from your own documentation, with the correct domain, not from search results. The InstallFix pattern works because the official install experience is a pasted one-liner; an internal copy page with the right command removes the ambiguity.

Never trust a download that arrives through a chat or an artifact. Shared AI conversations and published artifacts sit on vendor domains, which makes them feel safe, and the researchers documented stealer payloads behind them. The platform's own user-generated banner is the only warning you get, and it is easy to miss.

Treat a “verification” or “backup domain” page as the attack. Win+R, paste, enter is not a verification flow; it is a ClickFix execution pattern. Any instruction that asks a user to paste a command to prove they are human, or to continue on a backup domain, is the attack itself.

Put the marketing team in the security conversation. Ad accounts and billing access were explicit targets. The credentials that manage advertising budgets are business-critical, they are rarely covered by technical security controls, and the people who hold them are not usually the people reading security advisories. The fake advertising invitations documented here collected Google account credentials directly.

The awareness point connects to the broader theme of this month's coverage. The criminal campaigns documented here, the agent-driven intrusion campaign, and the Rank Math supply chain attack all share one property: the decisive step was performed by a person or a process that trusted something it should have verified. AI tools did not create that property. They made it profitable at scale.

For teams that want to go one level deeper, the attack chain anatomy in the research is worth studying rather than skimming, because it explains why the defences people usually rely on do not fire. There is no email to filter, because the lure arrived through search results or an advertisement. There is no file to scan, because the execution ran through built-in Windows binaries and the payload was fetched after the fact. There is no suspicious domain to block permanently, because the lure hosts rotated while the backend stayed constant, and some of the lures sat on domains no company will ever block. What remains constant is behaviour: a new PowerShell process started by a browser context, a headless browser with remote debugging, a scheduled task that should not exist. Behavioural monitoring catches what domain blocklists cannot, and that is the detection angle the researchers lead with.

A related pattern worth knowing, because it reaches the same employees through a different door, is the AI gateway. Teams that route their model calls through a gateway hold their provider keys, budgets and logs in one place, which makes the gateway itself a high-value target. That was demonstrated in the LiteLLM supply chain attack, where a poisoned package version sat on PyPI for under two hours and carried a credential stealer. The fake-AI campaigns and the poisoned package are two ends of the same problem: the AI tool supply chain, from the download page to the package registry, is now an attack channel, and every tool in it was trusted when it was added.

For marketers and business teams specifically, one practical layer exists that costs nothing: treat every AI tool signup the way finance treats a new vendor. Does it have a name you can verify, a domain that matches the real product, an entry on the approved list? The fake advertising invitations documented in the research collected Google credentials from people who manage ad budgets, and the whole flow looked like onboarding. A thirty-second check against the vendor's real domain catches most of it, and it is a habit rather than a product.

There is also a personal-finance angle that the researchers document quietly. Stolen browser sessions bypass MFA because the session cookie is the authenticated state. That means a stolen cookie from a machine that is logged into email, banking, advertising platforms and cloud consoles is a skeleton key for all of them, and the infostealers in these campaigns export exactly those cookies. Anyone whose browser holds authenticated sessions to money-moving services should treat browser hygiene, signing out of sensitive consoles, using separate browser profiles, and clearing sessions on machines that install unvetted software, as part of protecting the business, not just the laptop.

The final word belongs to the volume, because it reframes what kind of problem this is. A single campaign is an incident. A campaign category that has produced more than a hundred documented sessions every month for half a year, across at least nine impersonated brands, five distinct attack patterns, and multiple trusted hosting platforms, is an operating environment. That is what the 1,258 analyses describe: not a wave that will pass, but a permanent feature of searching for and adopting AI tools, one that will keep pace with every new product launch the industry ships. The teams that internalise that, and build the boring habits around tool approval and installer distribution, will stop seeing these campaigns as emergencies and start seeing them as background noise that never lands.

Where the numbers stop

Where the numbers stop

• The 1,258 figure counts public sandbox analyses, which are submissions to ANY.RUN's own service. It is a measure of observed activity in one sandbox product, not a census of the campaigns' reach, and the researchers do not claim otherwise.
• The country split, US submitters at 69 of 422 records, reflects who submitted the analyses to the sandbox, not who the victims were. The report phrases this carefully, and this article keeps the distinction.
• The research covers public analyses between two dates. Private or unsubmitted sessions, and campaigns outside that window, are not counted.
• ANY.RUN sells a sandbox product and threat intelligence services, which means the research also demonstrates the product. The chains are documented with reproducible session links, which is the part that matters for verification.
• I have not executed any of the documented chains, and no claim here is a hands-on finding.

FAQ

What are fake AI tool campaigns?

They are attack campaigns that impersonate AI products, Claude, ChatGPT, GitHub Copilot, Gemini and others, to deliver malware or steal credentials. Common patterns include fake download pages that instruct users to paste a command into PowerShell, trojanized installers that ship the real tool alongside a stealer, and lures hosted on the AI platforms' own domains as shared chats or published artifacts. ANY.RUN linked 1,258 public sandbox analyses to these campaigns between April and October 2026.

Which AI brands are impersonated the most?

Claude and ChatGPT dominate: Claude appeared in 48 percent of the analysed sessions and ChatGPT with Codex in 33 percent, together accounting for four in five. The full documented list also includes Codex, GitHub Copilot, Gemini, Ollama, OpenClaw, Perplexity and Manus. The practical implication is that the brands your team actually uses are the brands that will be impersonated at your team.

How do I protect my team from fake AI downloads?

Three habits cover most of it. Distribute AI tool installers from your own internal documentation so nobody copies install commands from search results. Teach the pattern: any page asking a user to paste a command into PowerShell or the Run dialog is the attack, regardless of how legitimate it looks. And put marketing and business teams, whose ad and billing accounts were explicit targets in this research, inside the security awareness conversation, because the technical controls that protect developers do not protect a Google Ads login.

The short version

Fake AI tool campaigns have sustained themselves for six months, with 1,258 documented sandbox sessions, Claude and ChatGPT impersonated in four of every five, and 45 percent of sessions involving the victim pasting a command into a shell. The lures live on trusted platforms, including the AI vendors' own domains, and the payload in the most convincing pattern is the genuine installer with a session stealer running behind it. The brands being impersonated are the brands teams actually use, and the employees holding ad and billing accounts are targets, not collateral. The defence is mostly organisational: an approved tool list, internally distributed installers, and a team that treats paste-this-command pages as the attack they are.

Sources

• ANY.RUN, Fake AI Tools Target US Companies: Claude, ChatGPT and Five Attack Patterns, the research covering the 1,258 analyses, the five attack patterns, the brand distribution and the detection markers: https://any.run/cybersecurity-blog/fake-ai-tools-us-companies