Fake AI attacks use trusted brands to spread malware
Fake AI attacks are imitating familiar services to spread malware, steal active browser sessions and compromise business accounts, according to research from ANY.RUN. The security company linked 1,258 public sandbox analyses to these campaigns between April and October 2026. US businesses represented 16% of targets for which a country was attributed, making the activity relevant to companies and managed security providers responsible for American environments.
The campaigns borrow the appearance of Claude, ChatGPT, GitHub Copilot, Gemini and other AI services. ANY.RUN found lures in sponsored search results, on legitimate hosting services, inside shared AI conversations and on counterfeit download sites. Employees are encouraged to run commands, install altered applications or enter credentials into fraudulent sign-in pages. Because the names and workflows appear familiar, an employee may believe they are carrying out an ordinary installation or authentication task.
In one campaign impersonating Claude, a page designed to resemble the service's official download site presented a Windows download button. Selecting it copied a command to the visitor's clipboard and showed instructions for running that command through PowerShell, a Windows tool used to automate and administer computers. The command did not install the expected application. Instead, it started mshta.exe, a legitimate Windows program capable of opening HTML Application files, retrieved a malicious HTA file and launched an encoded PowerShell sequence. ANY.RUN's completed analyses identified information-stealing malware activity in the resulting execution chain.
This method can complicate detection because the employee starts the process, legitimate Windows utilities perform parts of the activity and the malicious payload does not appear until several stages have run. ANY.RUN also identified recurring behaviour across the campaigns, including suspicious PowerShell installation commands, mshta.exe execution, encoded download instructions and scheduled tasks that opened browsers to steal sessions. A stolen browser session can let an attacker reuse an existing signed-in state rather than beginning with a normal login.
The campaigns create a particular workload for a managed security service provider, or MSSP, which monitors and responds to threats for multiple customers. Domains, hosting services and impersonated AI brands can change while the underlying actions remain similar. Separate customers may also use different technologies, policies and risk classifications, forcing analysts to investigate variations of the same technique repeatedly.
ANY.RUN divided that operational pressure into three areas. Monitoring teams must maintain coverage while attackers rotate infrastructure and brands. Triage teams must examine layered execution chains, which can increase workloads and escalations. Threat hunters must then correlate findings and turn them into reusable detection rules for other customer environments. The affected operational measures include mean time to detect, mean time to respond, escalation rates, investigation costs and compliance with service level agreements.
The company says its Interactive Sandbox lets analysts reproduce clicks and other interactions in an isolated environment while observing processes, network connections and malicious behaviour. A sandbox is a separated testing environment intended to prevent suspicious software from directly affecting normal systems. ANY.RUN reports a median threat-detection time of 14 seconds and 30% fewer escalations from Tier 1 analysts to more experienced Tier 2 staff when its sandbox is used. These are vendor-reported operational figures associated with its own service.
ANY.RUN also says its Threat Intelligence Feeds provide indicators of compromise, or IOCs, extracted from malware and phishing investigations. An IOC is a technical clue, such as malicious infrastructure, that may help identify related activity. The feeds can be incorporated into Security Information and Event Management systems, which collect and analyse security events, and Endpoint Detection and Response tools, which monitor computers for suspicious behaviour. According to the company, 30% of unique malicious IOCs found by its customers during sandbox investigations are already in the feeds. It also claims that 99% of its feed indicators are unique compared with other intelligence sources.
For investigation and hunting, ANY.RUN's Threat Intelligence Lookup connects suspicious indicators with malware behaviour, previous sightings and related campaign infrastructure. The stated aim is to let an MSSP take evidence from an infection at one customer, check for connected activity elsewhere and update detection rules around behaviour instead of relying only on domains that attackers can replace. The company says its threat-intelligence products provide access to 24 times more IOCs per incident.
Additional vendor-reported figures include a 36% higher detection rate, up to 58% more threats identified and a 21-minute reduction in response time. ANY.RUN presents these results as a way to reduce repetitive investigations, preserve experienced analysts for more complex incidents and maintain service levels as alert volumes grow. The publication carrying the findings identifies the article as a contributed piece from a partner, so readers should understand that the operational performance claims form part of a vendor presentation, while the described infection chain and campaign observations are attributed to ANY.RUN's analyses.
For website owners and business IT teams, the immediate lesson is that a polished download page, hosted content or sponsored result should not be treated as trustworthy solely because it resembles a recognised AI service. Unexpected instructions to paste commands into PowerShell are especially significant because they bypass the normal application-installation process and can begin a multistage infection. Organisations should also search managed devices for the recurring behaviours documented by ANY.RUN rather than depending only on website addresses that may quickly change.
For businesses reviewing the wider management of their technology environment, AEU-I provides security-first IT, infrastructure and consulting. Fake AI attacks ultimately rely on a person accepting a false installation or sign-in flow, so clear software-installation procedures and prompt review of unusual account activity remain important alongside technical monitoring.