AI Tools Like Claude, ChatGPT, and Copilot Used as Bait for Malware Distribution
Cybercriminals are impersonating popular AI tools to trick users into downloading malware through fake websites, browser extensions, and malicious ads.
Cybercriminals are increasingly leveraging the popularity and trust associated with artificial intelligence tools like Claude, ChatGPT, and Microsoft Copilot to distribute malware. Attackers are creating deceptive online presences, including fake download pages, browser extensions, and search advertisements, to lure unsuspecting users into executing malicious commands or installing harmful software such as backdoors, password stealers, and browser hijackers.
Sophos researchers observed this trend across numerous investigations, noting that Claude was the most frequently abused AI brand. The campaigns exploit the user's trust in familiar AI names, aiming to compromise both individuals and organizations. The stolen data can include browser sessions, saved passwords, private files, and cryptocurrency wallet information, providing attackers with a potential entry point into wider corporate systems.
Attackers often employ techniques like 'InstallFix,' a social-engineering method where victims are presented with a seemingly legitimate installation guide that instructs them to copy and run a command. This command then downloads and executes the actual malware payload. For instance, a fake Claude site might direct users to run an mshta command to retrieve a malicious Windows application package, which then executes code directly in memory, attempting to mask its activity within a legitimate browser process.
This tactic mirrors other malware delivery campaigns that rely on fake verification pages to trick users into running commands, effectively turning user actions into the initial stage of an infection. Beyond fake installers, Sophos also identified AI-themed browser extensions that, despite appearing useful, secretly collect browser data and communicate with attacker-controlled servers. These extensions are particularly attractive to data thieves due to the broad access they can obtain to user sessions and stored credentials.
One concerning example involved a fake Perplexity extension that hijacked user searches and exfiltrated browsing telemetry in real time. Alarmingly, some malicious extensions have appeared on official marketplaces like the Chrome Web Store, complete with high ratings and numerous reviews, creating a false sense of credibility that can lower user suspicion. Attackers are also using legitimate platforms, such as shared conversations on ChatGPT infrastructure, to host malicious lures, instructing victims to paste terminal commands that lead to infections.
To combat this growing threat, users are strongly advised to download AI tools exclusively from confirmed vendor domains. Organizations should implement rigorous security practices, including auditing AI-related browser extensions, verifying publisher information before installation, and removing unnecessary extensions. Security teams should also monitor for unusual command executions, suspicious PowerShell activity, and browser processes launching system utilities, as these behaviors can indicate a compromise even when the initial lure is sophisticated.
Sophos also documented instances of poisoned packages and malicious plugins that fetched remote code, highlighting the need for robust supply-chain security controls for AI dependencies, similar to those applied to other software packages. The speed at which automated development tools can operate means the window between a malicious package being published and executed can be significantly reduced, underscoring the urgency of these security measures.