Loading story…
Attackers are increasingly impersonating popular AI brands to deliver malware and steal credentials, with Sophos reporting that fake installers and malicious browser extensions tied to names such as ChatGPT, Claude, Copilot, Perplexity, and Gemini now account for a significant share of confirmed AI-related incident cases. In a 12-month review of 86 MDR cases tagged for suspected AI activity, Sophos confirmed 38 as genuine adversarial AI incidents; 35 involved malicious targeting of AI, and 30 specifically involved AI software impersonation. The company said it found no confirmed cases of fully AI-orchestrated intrusions in its telemetry, indicating that the dominant threat remains conventional social engineering wrapped in AI branding.
One recent case investigated by Darktrace used a fake Google Gemini installer to deploy the Vidar infostealer inside an EMEA company network. The campaign abused Google Colab as a trust-building lure before redirecting the victim to a fake "Windows Software Hub" page hosting Download_Google_Gemini_For_Windows.exe; the payload was a newer Go-compiled Vidar variant using Telegram-based infrastructure and the command-and-control domain dtm[.]kijangturbo88[.]top. Darktrace said the malware activity was consistent with browser credential theft and other data theft, and that it blocked the outbound communications and quarantined the affected device, underscoring the need for verified software sources, browser extension controls, supply-chain review, and better visibility into unmanaged systems.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
The 12-month Sophos MDR review window closed on June 29, 2026, forming the basis for its analysis of attacker abuse of AI brands and other adversarial AI activity.
Sophos X-Ops began the MDR casework review window it later used to analyze suspected AI-related activity, covering cases from July 2, 2025 through June 29, 2026.
In a separate incident, attackers compromised a financial services organization's custom PHP application through SQL injection and deployed a Rust-based remote access Trojan that polled Slack for commands. Sophos linked the malware to a public GitHub repository whose commit history indicated a human developer working with a Claude coding agent.
Darktrace said its Autonomous Response system blocked the malware's communications, including traffic to dtm[.]kijangturbo88[.]top and Telegram-based infrastructure, and quarantined the infected device.
In the Gemini-themed campaign, attackers used a Google Colab-hosted lure that redirected victims to a fake "Windows Software Hub" page hosting Download_Google_Gemini_For_Windows.exe, with a ZIP archive and README instructing users to run the file as administrator and add AV exclusions.
Darktrace investigated an incident on a company network in the EMEA region where a malicious executable posing as a Google Gemini installer delivered a newer Go-compiled Vidar infostealer.
Sophos confirmed execution of a poisoned LiteLLM PyPI package and a claude-mem npm plugin installed through NPX that fetched code from a remote GitHub repository, though it could not determine whether a human or AI agent initiated the installs.
Sophos documented AI-branded social-engineering activity including fake Microsoft Copilot document shares redirecting victims to an EvilProxy adversary-in-the-middle kit, OpenAI-themed credential harvesting, and ClickFix-style prompts that tricked users into running commands.
Sophos investigated a case in which four customers installed a fake Perplexity browser extension distributed through the Chrome Web Store; the extension hijacked searches, redirected traffic through perplexity-ai[.]online, and exfiltrated browsing telemetry.
From its 12-month review, Sophos confirmed 38 AI-related adversarial cases, with 35 involving malicious targeting of AI and 30 specifically involving AI software impersonation such as fake installers and malicious browser extensions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence reported that threat actors are exploiting the popularity of AI platforms including **ChatGPT**, **Claude**, **DeepSeek**, and **Flux Pro AI** to drive phishing, malvertising, and malware delivery rather than compromising the vendors themselves. One ChatGPT-themed campaign, aimed largely at South African users, used payment-update emails and redirect chains through legitimate services to a compromised site that harvested personal and credit card data. A separate Claude-themed operation targeted more than 2,000 organizations and likely used adversary-in-the-middle techniques to steal Microsoft sign-in credentials and authentication tokens. Microsoft also linked large-scale AI-themed malvertising to **Storm-3075**, which pushed fake AI plugin downloads and delivered malware including **Vidar Stealer**, **Lumma Stealer**, **Hijack Loader**, and **Oyster**, with parts of the chain tied to **Fox Tempest** malware-signing services. In another case, attackers created a fake **DeepSeek V4** GitHub repository within hours of the model’s launch, using copied benchmark data, official-looking branding, SEO tactics, and rotating payloads to distribute **Vidar** and **GhostSocks** malware before GitHub removed the infrastructure. Microsoft said it revoked certificates, disrupted Fox Tempest infrastructure with partners, and coordinated takedowns, while urging defenders to strengthen MFA, conditional access, browser protections, and endpoint and email defenses.
Jun 29, 2026
Attackers are targeting macOS users with fake AI tool downloads promoted through **Google Ads** and public **Claude.ai** shared chats. Victims searching for terms such as “Claude mac download” are shown sponsored results that appear to reference the legitimate `claude.ai` domain, but the links redirect to shared chats containing bogus installation instructions. The lures present themselves as official guidance for running Claude-related tools on Mac, sometimes even masquerading as Apple Support content, and tell users to paste commands into Terminal that instead fetch and execute malware. Researchers said the campaign is active and uses rotating malicious chat pages and infrastructure to evade disruption. Observed payloads include Mac-focused infostealers with behavior consistent with **AMOS** and **Amatera/MacSync-style** theft, including collection of browser credentials, cookies, and **Keychain** data. The activity reflects a broader trend of threat actors disguising malware as AI agents and developer tools to exploit demand for generative AI software on macOS systems.
Jun 29, 2026
Threat actors have launched sophisticated malware campaigns that exploit legitimate AI chat platforms, such as ChatGPT and Grok, to deliver malicious code to unsuspecting users. By using SEO poisoning and sponsored Google search results, attackers redirect users searching for common macOS troubleshooting tips to fake shared chat links on these AI platforms. These chats appear to offer helpful system instructions but actually embed obfuscated, base64-encoded commands that, when executed, install multi-stage malware. The infection process often involves social engineering tactics, such as prompting users to enter their system password under the guise of credential verification, which is then used to escalate privileges and deploy the main malware payload. Security researchers have identified the malware as variants of information stealers, including Shamus and AMOS, which are capable of stealing credentials and cryptocurrency, and employ advanced evasion techniques like multi-layered encoding and custom decoders to avoid detection. This attack method is particularly effective because it leverages the inherent trust users place in well-known AI brands and their official domains, bypassing traditional safety checks. The campaigns highlight a growing trend in cybercrime where legitimate AI tools are weaponized to facilitate malware delivery, making detection and prevention more challenging. Security analysts emphasize the need for increased vigilance when interacting with AI-generated content, especially when prompted to execute system commands, and recommend enhanced monitoring for suspicious activity originating from AI platform interactions.
Jun 29, 2026