ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Victim

financial services organization

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Attackers impersonate popular AI brands to spread malware

Sophos documented 38 MDR cases where attackers impersonated AI brands like Claude and Perplexity to deliver infostealers and backdoors.

Sophos X-Ops analyzed 12 months of MDR cases and confirmed 38 incidents involving AI. Software impersonation accounted for 30 cases, with Claude impersonated in 26; fake installers used an 'InstallFix' technique delivering mshta commands, in-memory payloads, and process hollowing. Malicious browser extensions posing as AI assistants, including a fake Perplexity extension with 10,000 installs, acted as infostealers. In one case, attackers used a Claude coding agent to develop a Rust remote access trojan communicating over Slack after an SQL injection compromise.

Help Net Security · 26d agoThreat actor in the wild

Appears with

malware Rust remote access trojan 1ai model ChatGPT 1ai model Claude 1ai model Copilot 1ai model DeepSeek 1ai model Perplexity 1product Chrome Web Store 1product Slack 1vendor Sophos 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.