Attackers are posing as well-known AI products to push malware, hijack browser sessions and take over business accounts, according to ANY.RUN, which tied 1,258 public sandbox analyses to fake AI campaigns between April and October 2026.

US businesses bore the brunt, accounting for 16% of country-attributed targets, the firm said. The campaigns impersonate Claude, ChatGPT, GitHub Copilot, Gemini and other AI services through sponsored search results, legitimate hosting services, shared AI conversations and counterfeit download sites.

One campaign mimicking Claude shows how easily a routine install turns into an infection. A victim lands on a page resembling the official Claude download site; clicking the Windows button copies a command to the clipboard with instructions to run it in PowerShell. The command launches mshta.exe, pulls a malicious HTA file and triggers an encoded PowerShell chain. Because the employee starts the process and the attack leans on built-in Windows tools, detection is hard.

For MSSPs, similar activity across customers with different tools, policies and risk profiles means repeated investigations and stretched analysts. ANY.RUN says its sandbox cuts Tier 1 to Tier 2 escalations by 30% with a median detection time of 14 seconds, while its threat intelligence feeds offer 99% unique IOCs.

Source: The Hackers News