The Internet is littered with convincing counterfeit AI offerings that, instead of providing popular tools, drop infostealers, remote access Trojans (RATs), and other threats inside enterprise networks.
In a report this week, Any.Run researchers examined threat campaigns that use AI-themed lures that impersonate leading brands such as Claude, ChatGPT, and others. Over a six-month period, a full 1,258 incidents analyzed on the firm's platform traced back to fake AI tool attacks.
The lures were presented in a variety of ways, from SEO poisoning and malicious ads to fake download pages and AI-themed artifacts. The campaigns most often impersonated Anthropic's Claude, with 60% of the analyses, and OpenAI's ChatGPT and Codex representing 33% of the analyses. Any.Run researchers also found the attacks frequently used a familiar tactic.
"The attacks share one trait: the employee performs the decisive step. They paste an 'install command,' run a convincing installer, or sign in to a fake window," the report stated. "That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations."
The 1,258 analyses indicate these types of attacks are on the rise, according to Any.Run's research team.