Full Report
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks
Analysis Summary
# Tool/Technique: Fake AI Product Impersonation (Infostealer Distribution)
## Overview
This attack technique involves threat actors creating fraudulent websites and advertisements that impersonate popular Artificial Intelligence (AI) platforms. The goal is to deceive users into executing malicious commands or downloading "desktop versions" of AI tools to deploy infostealers, compromise business accounts, and hijack browser sessions.
## Technical Details
- **Type:** Malware Campaign / Social Engineering
- **Platform:** Windows (primarily), Web Browsers
- **Capabilities:** Credential theft, session hijacking, execution of multi-stage PowerShell scripts, and unauthorized access to business environments.
- **First Seen:** April 2026 (Significant uptick observed through October 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (Fake download pages)
- [T1583.008 - Acquire Infrastructure: Malvertising] (Sponsored search results)
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1218.005 - System Binary Proxy Execution: Mshta]
- [T1204.002 - User Execution: Malicious File]
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- **[TA0005 - Evasion]**
- [T1027 - Obfuscated Files or Information] (Encoded PowerShell)
## Functionality
### Core Capabilities
- **Brand Impersonation:** Detailed spoofing of Claude, ChatGPT, GitHub Copilot, and Gemini interfaces to build trust.
- **Clipboard Hijacking/Manipulation:** Deceiving users into copying a "command" to their clipboard which actually contains malicious code.
- **Living-off-the-Land (LotL):** Utilizing native Windows binaries like `mshta.exe` and `powershell.exe` to bypass traditional file-based detection.
### Advanced Features
- **Multi-stage Execution:** The initial trigger (HTA file) leads to an encoded PowerShell chain, which then fetches the final infostealer payload, making static analysis difficult.
- **Evasive Hosting:** Rotating domains and using legitimate hosting services to bypass reputation-based web filters.
## Indicators of Compromise
- **File Hashes:**
* *Note: Specific hashes vary per sub-campaign; see ANY.RUN task [bbfbbb49-9676-47a6-8f62-234c70fa46c3] for specific analysis samples.*
- **File Names:** `Claude_Desktop_Install.hta`, `ChatGPT_Assistant.exe`, `Copilot_Setup.ps1`
- **Registry Keys:** Check for persistence in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` linked to PowerShell or MSHTA.
- **Network Indicators:**
* `hxxps[:]//claude-desktop[.]com` (Example of spoofed domain)
* `hxxps[:]//ai-tool-update[.]xyz`
* `hxxp[:]//[C2-IP]/payload.ps1`
- **Behavioral Indicators:**
* `mshta.exe` making external network connections to unknown IPs.
* `powershell.exe` executing base64 encoded strings immediately after a browser download action.
## Associated Threat Actors
- Unknown (Activity characterized by widespread, opportunistic campaigns targeting US-based business users and MSSP clients).
## Detection Methods
- **Signature-based detection:** Scanning for specific HTA file structures and known infostealer headers.
- **Behavioral detection:** Monitoring for `mshta.exe` launching `powershell.exe` with command-line arguments containing "FromBase64String" or "IEX".
- **YARA rules:** Rules targeting suspicious HTA files that contain `AutoOpen` or script execution tags following AI-themed strings.
## Mitigation Strategies
- **Prevention measures:** Implement strict web filtering to block newly registered domains (NRDs) and AI-themed keywords in non-standard URLs.
- **Hardening recommendations:** Restrict the execution of `mshta.exe` via AppLocker or Windows Defender Application Control (WDAC).
- **User Education:** Train employees to only download AI tools from verified official domains (e.g., anthropic.com, openai.com) and to never paste commands directly into PowerShell from a website.
## Related Tools/Techniques
- **Click-to-Console:** A similar technique where users are tricked into opening a console and pasting code.
- **SEO Poisoning:** Used to drive traffic to these fake AI portals.
- **LUMMA / RedLine Stealer:** Common infostealer families often delivered via these fake AI lures.