Any.Run found 1,258 fake Claude and ChatGPT campaigns using ClickFix to infect developers with malware.
Any.Run reports a surge in campaigns impersonating AI tools, especially Anthropic’s Claude (60% of analyses) and OpenAI’s ChatGPT and Codex (33%). Across six months, 1,258 investigations on its platform traced to these lures, delivered through SEO poisoning, malicious ads, and fake download pages. ClickFix-style tactics accounted for nearly half, with employees pasting install commands, running fake installers, or signing into fake windows. The campaigns drop infostealers and remote access trojans that can expose source code, cloud and AI API keys, and business accounts.
Any.Run tied 1,258 analyses over six months to fake AI-tool attacks.
Claude lures were 60% of analyses; ChatGPT and Codex were 33%.
Nearly half used ClickFix-style prompts that make users run commands or installers.
Payloads include infostealers and RATs that can expose code and API keys.
Indicators of compromiseauto-extracted · verify before use · export allAll →
Type
Indicator
Context
md5
1d1c29eff49426577dcf3e84cf3b98ff
k-openclaw-cline-users#recipe=similar-items&sourcecontentid=1d1c29eff49426577dcf3e84cf3b98ff) Supply Chain Attack Secretly Installs OpenClaw for Cline
md5
1e51d280261e34e0cc1db58fc4422dce
tepad-updates-6-months#recipe=similar-items&sourcecontentid=1e51d280261e34e0cc1db58fc4422dce) Chinese Hackers Hijack Notepad++ Updates for 6 Months by
md5
208b9846191967c692e5c2bf1e972959
ay-light-patch-tuesday#recipe=similar-items&sourcecontentid=208b9846191967c692e5c2bf1e972959) Microsoft Fixes Exploited Zero Day in Light Patch Tuesday
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.
Rob Wright,Senior News Director,Dark Reading
October 16, 2026
5 Min Read
Source: Ekaterina Goncharova via Getty Images
The Internet is littered with convincing counterfeit AI offerings that, instead of providing popular tools, drop infostealers, remote access Trojans (RATs), and other threats inside enterprise networks.
In a report this week, Any.Run researchers examined threat campaigns that use AI-themed lures that impersonate leading brands such as Claude, ChatGPT, and others. Over a six-month period, a full 1,258 incidents analyzed on the firm's platform traced back to fake AI tool attacks.
The lures were presented in a variety of ways, from SEO poisoning and malicious ads to fake download pages and AI-themed artifacts. The campaigns most often impersonated Anthropic's Claude, with 60% of the analyses, and OpenAI's ChatGPT and Codex representing 33% of the analyses. Any.Run researchers also found the attacks frequently used a familiar tactic.
"The attacks share one trait: the employee performs the decisive step. They paste an 'install command,' run a convincing installer, or sign in to a fake window," the report stated. "That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations."
The 1,258 analyses indicate these types of attacks are on the rise, according to Any.Run's research team.
"This number alone shows how widespread the problem has become, especially considering that security teams from over 16,000 companies worldwide use Any.Run to investigate suspicious activity," a research team spokesperson tells Dark Reading. "While it's impossible to confirm the exact number of infections, the data suggests these campaigns reached a significant number of users."
L o a d i n g...
ClickFix, InstallFix & AI-Themed Lures
Any.Run's report showed that ClickFix-type tactics made up nearly half of the AI-themed campaigns it studied. Fake command-line interface (CLI) installers or InstallFix attacks represented 27% of the analyses, while traditional ClickFix attacks that began with fake download pages accounted for 17%. Meanwhile, attack chains that began with abused AI chats or malicious artifacts represented 25%.
"Fake AI and ClickFix are closely connected," the Any.Run spokesperson says, highlighting that 45% of the analyses involved the threat actor asking a victim to copy and paste a command into their interface. "This shows how widely attackers are already combining AI-themed lures with ClickFix techniques."
The lures typically offer fake CLI installers for various AI tools on GitHub pages or copied documentation hosted on trusted platforms such as Cloudflare Pages, GitLab Pages, Google Sites, GitHub, or even the AI platforms themselves, primarily targeting developers. Meanwhile, fake ads and SEO poisoned search results are usually aimed at marketing personnel.
"We expect fake AI lures to become even more common as new AI tools continue to launch and public interest remains high," the research team says. "People often search for installation instructions without knowing which sources to trust, and attackers take advantage of this."
AI-themed InstallFix and ClickFix variants are designed to compromise developer workstations to obtain a target organization's source code, SSH keys, CI/CD tokens, and cloud and AI API keys. "This approach is particularly effective against developers, since installing legitimate AI coding tools often involves running terminal commands," the spokesperson says. "That makes malicious instructions easier to disguise as normal installation steps."
And while marketing professionals may be less attractive targets for threat actors, Any.Run warned that those attacks could compromise credentials for high-value business accounts.
In addition to increasingly prevalent InstallFix and ClickFick attacks, other types of AI-themed threats are also gaining steam. For example, a technique known as "LLMshare" has proven quite effective, according to Push Security.
LLMShare involves threat actors creating content on AI platforms in shared chats that often appear to offer installation guidance and service updates that contain malware, using malvertising and SEO poisoning to drive traffic to the malicious chats. Shared artifacts follow a similar track, as the attackers publish the malicious content directly to the AI platforms.
"The recent variants using shared chats, artifacts, and most recently custom GPTs are particularly nasty," Dan Green, researcher at Push Security, tells Dark Reading. These are legitimate AI sites (it's the real Claude, ChatGPT, etc. domain), and so people don't expect to be served a malicious link there.
Green adds that, like InstallFix, LLMshare has proven to be very effective, because it takes advantage of "very normal interactions and behaviors online" in today's era of rapid AI adoption. In fact, AI-themed InstallFix attacks make up 5% to 10% of Push Security's monthly detections, and the number is growing every month.
"Today, everyone is encouraged to use AI tools, and many are legitimately installed via the command line," Green says. "You have regular users working more like developers, making it easy for attackers to manipulate them."
Any.Run researchers emphasized that because many of these attacks are using legitimate domains and are sometimes hosted directly on the very AI platforms they're trying to use, detection can be challenging. But there are ways to mitigate the threat, starting with employee behavior.
"Every pattern in this research starts with an employee looking for an AI tool on their own," the report stated. "Publish a short list of approved AI tools with their official sources (vendor site, winget, Homebrew, or the vendor's package) and install them through MDM or the software portal."
Any.Run researchers also recommended that security teams restrict standard users' ability to paste and run commands, while also training employees to always verify install commands against a vendor's official documentation rather than relying on third-party links, ads, shared chats, or other sources.
Rob Wright is a longtime reporter with more than 25 years of experience as a technology journalist. Prior to joining Dark Reading as senior news director, he spent more than a decade at TechTarget's SearchSecurity in various roles, including senior news director, executive editor and editorial director. Before that, he worked for several years at CRN, Tom's Hardware Guide, and VARBusiness Magazine covering a variety of technology beats and trends.
Prior to becoming a technology journalist in 2000, he worked as a weekly and daily newspaper reporter in Virginia, where he won three Virginia Press Association awards in 1998 and 1999. At TechTarget and Dark Reading, he has won several Azbee awards, including the 2026 National Silver Award for a series on vibe coding.
At Dark Reading, Rob currently covers security operations, cloud security, and Internet infrastructure. He has a keen interest in malvertising activity and the certificate authority industry, and has written extensively on both topics. He graduated from the University of Richmond in 1997 with a degree in journalism and English. A native of Massachusetts, he lives in the Boston area.
Want more Dark Reading stories in your Google search results?
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Informa TechTarget|
