Attackers impersonate popular AI brands to spread malware
Sophos documented 38 MDR cases where attackers impersonated AI brands like Claude and Perplexity to deliver infostealers and backdoors.
Sophos X-Ops analyzed 12 months of MDR cases and confirmed 38 incidents involving AI. Software impersonation accounted for 30 cases, with Claude impersonated in 26; fake installers used an 'InstallFix' technique delivering mshta commands, in-memory payloads, and process hollowing. Malicious browser extensions posing as AI assistants, including a fake Perplexity extension with 10,000 installs, acted as infostealers. In one case, attackers used a Claude coding agent to develop a Rust remote access trojan communicating over Slack after an SQL injection compromise.
- Software impersonation drove 30 of 38 confirmed AI-related incidents
- Claude was the most impersonated brand, appearing in 26 cases
- InstallFix variant walks users through fake installer guides to run commands
- Fake Perplexity Chrome extension hijacked searches and exfiltrated browsing data
- Attackers used a Claude coding agent to build a Slack-based Rust RAT
- ATT&CK
- T1566.002 Malicious LinkT1204.002 Malicious FileT1036 MasqueradingT1190 Exploit Public-Facing ApplicationT1059.001 PowerShell
- Vendors
- Sophos
- Products
- Chrome Web StoreSlack
- Malware
- Rust remote access trojan
From the original article
3 min read at helpnetsecurity.com
Attackers are impersonating popular AI brands like Perplexity, Claude , ChatGPT , and Copilot to spread information stealers, backdoors, malicious browser extensions, and other malware, according to Sophos. Sophos X-Ops reviewed 12 months of managed detection and response cases, covering July 2, 2025 through June 29, 2026.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.