Fake AI apps steal credentials and plant malware, ANY.RUN says
Original title: The AI Adoption Blind Spot: How Fake AI Tools Put Enterprises at Risk
Researchers tied 1,258 public sandbox analyses from April 15 to October 5 to campaigns impersonating popular AI brands.
ANY.RUN says criminals are impersonating ChatGPT, Claude, Microsoft Copilot, and Google Gemini with counterfeit sites, ads, and installers aimed at corporate users. Fake coding assistants, a fraudulent Claude Ads Google sign-in, and a trojanized Claude installer that collected browser data were observed in sandboxes. Delivery includes malicious installers and terminal commands presented as setup steps, followed by stealers or other malware and theft of passwords, cookies, and tokens. Windows is the main target, but macOS users were also asked to paste commands into Terminal.
Unconfirmed: Detection-rate and response-time improvements are vendor-reported figures, not independently confirmed.
- India accounted for 20% of submissions with country data; the US for 16%.
- Technology appeared in all seven campaign queries examined.
- A fake GitHub Copilot CLI page served malicious install instructions.
- A fake Claude Ads page used a fraudulent Google sign-in to capture credentials.
- ANY.RUN says more than 16,000 organizations use its platform.
Impact: Credential, session, and browser-data theft via fake AI apps
- 1.Treat unexpected AI installer pages and terminal setup commands as malicious.
- 2.Review developer and marketing accounts exposed to fake AI sign-in pages.
- ATT&CK
- T1036 MasqueradingT1204.002 Malicious FileT1059 Command and Scripting InterpreterT1539 Steal Web Session Cookie
- Products
- Google GeminiGitHub Copilot
- Organizations
- ANY.RUN
- Countries
- United StatesIndia
- AI models
- ChatGPTClaudeMicrosoft CopilotGemini
From the original article
4 min read at cybersecuritynews.com
AI adoption is accelerating across enterprises, with employees increasingly relying on platforms like ChatGPT, Claude, and Microsoft Copilot for everyday work. Cybercriminals are exploiting this growing trust, distributing malicious applications disguised as legitimate AI tools to steal credentials, deliver malware, and gain access to corporate environments. Recent research by ANY.
By Balaji N · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.