Attackers Impersonate Popular AI Brands to Distribute Malware
Cybercriminals are leveraging the popularity of AI services like ChatGPT and Claude to trick users into downloading malware, including information stealers and backdoors.
Threat actors are increasingly impersonating well-known artificial intelligence brands, such as Perplexity, Claude, ChatGPT, and Copilot, to distribute a variety of malware. Sophos X-Ops researchers analyzed 12 months of managed detection and response cases, identifying 34 confirmed malicious incidents involving AI, with an additional four cases uncovered during separate investigations, bringing the total to 38.
In the majority of these incidents, attackers targeted AI products, brands, or their associated ecosystems. Software impersonation was a prevalent tactic, accounting for 30 of the 38 cases. The AI chatbot Claude was the most frequently impersonated brand, appearing in 26 of the reviewed incidents. These fake applications often employed techniques similar to the known 'ClickFix' method, presenting polished installation guides that ultimately led users to execute malicious commands.
One notable example involved a fake Claude installer that prompted victims to run an mshta command. This command downloaded a payload from a lookalike domain, disguised as a Windows application named "claude" or "claude.msixbundle." Once executed, the payload attempted to inject malicious code into browser processes. Other variants included booby-trapped Claude Setup archives and repackaged .exe files designed to act as malware loaders.
Researchers emphasized that effective defenses against these impersonation attacks relied on conventional security measures rather than AI-specific characteristics. The primary recommendation for users remains to install AI tools exclusively from verified vendor domains to avoid falling victim to these deceptive schemes.
Beyond fake installers, attackers also created malicious browser extensions that mimicked AI assistants. One such extension, marketed as "AI Sidebar with DeepSeek, ChatGPT, Claude," was found to function as an information stealer, communicating with command-and-control servers. In another instance, a fake Perplexity extension distributed via the Chrome Web Store successfully hijacked user searches and exfiltrated browsing data in real-time.
The report also highlighted a case where attackers appeared to use AI for malware development. Researchers discovered a remote access Trojan communicating via Slack, linked to a GitHub repository. The commit history of this repository showed evidence of a human user collaborating with a Claude coding agent to develop the Rust-based malware, which was designed to execute commands, retrieve files, and establish persistence.
While Sophos found no evidence of AI operating attacks autonomously, they observed instances where AI-generated code or AI assistance played a role in malware development. These findings suggest a growing trend of threat actors leveraging AI capabilities to enhance their attack tooling and methods, making it crucial for security professionals and users alike to remain vigilant against AI-themed social engineering and malware distribution tactics.