Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot

Reporting by Any.run BlogRead the original at any.run

Executive Summary

Threat actors are leveraging the widespread adoption of AI tools to deploy infostealers and remote access trojans (RATs) through highly targeted social engineering. By impersonating brands like Claude and ChatGPT, these campaigns deceive employees—particularly developers and marketers—into executing malicious PowerShell commands, running trojanized installers, or providing credentials via fake sign-in windows. The attacks frequently utilize trusted hosting platforms and sponsored search results to bypass traditional email filters, effectively turning routine software installation habits into execution paths for malware.
The risk extends beyond individual account compromise to the exposure of high-value corporate assets, including source code, API keys, and billing accounts. While some attacks utilize lookalike domains, others embed lures directly within legitimate AI platforms using shared chats or artifacts. Defenders face challenges due to the rapid rotation of lure domains; however, behavioral patterns—such as specific backend API paths and the abuse of built-in Windows binaries—remain relatively stable markers for detection.

Facts Only

* ANY.RUN researchers analyzed 1,258 public sandbox submissions between April 15 and October 5, 2026.
* Campaigns impersonated AI brands including Claude, ChatGPT, GitHub Copilot, Gemini, Ollama, OpenClaw, Perplexity, and Manus.
* Claude and ChatGPT accounted for 81% of analyzed cases.
* India was the largest source of submissions; the USA was the second largest.
* The USA ranked first in submissions for ChatGPT-themed chains and the "Download Claude" campaign.
* 45% of analyses involved campaigns directing users to paste commands into Run dialogs, PowerShell, or Terminal.
* Lures were hosted on GitHub, GitLab Pages, Cloudflare Pages, Google Sites, claude.ai, and chatgpt.com.
* Outcomes included delivery of infostealers, RATs, and the theft of browser sessions and credentials.
* Target roles included developers and marketing teams.
* Observed techniques included mshta abuse, trojanized installers, and browser-in-the-browser phishing.

Full Take

The strongest version of this narrative is a technical warning: the "frictionless" installation culture of modern development (one-liner shell commands) has created a systemic vulnerability that attackers are now systematically exploiting.
However, this analysis functions as a classic vendor advertorial. It uses precise numerical data and high-stakes threat intelligence to establish a problem—"Shadow AI" and sophisticated delivery chains—only to position its own suite of products (Interactive Sandbox, TI Lookup, TI Feeds) as the necessary solution. By framing the threat as an evolving, high-volume campaign, it creates a psychological urgency that directs the reader toward a specific commercial ecosystem.
Patterns detected: ARC-0061 Authority Game, ARC-0012 Fear Appeal
The root cause is the erosion of the "trust boundary" between a user and their operating system. We have conditioned a generation of power users to trust any command that looks like official documentation. This echoes the historical transition from trusted physical media to trusted digital repositories, where the "source" is often assumed to be secure if the "platform" (GitHub, Cloudflare) is reputable.
The second-order consequence is a push toward more restrictive "locked-down" environments. While this increases security, it risks stifling the very agility and experimentation that drive AI adoption, potentially shifting agency from the individual professional to centralized IT gatekeepers.
Bridge Questions:
1. If we remove the commercial call-to-action, does the technical evidence suggest a systemic shift in attacker behavior or a standard evolution of phishing?
2. How can organizations balance the need for "Approved AI Catalogs" with the speed of innovation required in AI development?
Counterstrike Scan: A coordinated campaign would use fear of "invisible" AI threats to force the adoption of a specific security vendor's telemetry. While the structural alignment exists here, it is a standard B2B marketing funnel rather than a malicious influence operation.

From the original · Any.run Blog

ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India.

Read the full story at any.run

Sentinel — Human

Confidence

This analysis appears to be a detailed, expert-level breakdown of threat intelligence, exhibiting high specificity and structured reasoning typical of human forensic reporting rather than generic synthetic output.

Signals Detected

Sentence length variance is erratic, typical of detailed investigative reporting rather than uniform AI rhythm.

The text successfully transitions between broad statistical findings and highly specific, technical attack patterns (e.g., command strings, specific domain names), demonstrating deep contextual organization.

The intricate structure, cross-referencing of 1,258 analyses, and the detailed mapping to MITRE ATT&CK techniques suggest a structured, expert synthesis, not simple aggregation.

The inclusion of highly specific technical IOCs (SHA-256 hashes, precise command execution paths, domain structures) and the detailed forensic breakdown suggests real or meticulously constructed, high-fidelity source material.

Human Indicators

The inclusion of specific post-attack artifacts (e.g., .exe filenames, PowerShell chains, API calls) and the concluding segment that reads like a direct expert's methodology strongly suggests human forensic analysis.

The nuanced framing in the conclusion—focusing on behavioral detection over static indicators—is characteristic of security research synthesis.