Recent security findings reveal sophisticated campaigns where attackers impersonate popular AI tools like ChatGPT, Claude, Gemini, and GitHub Copilot to distribute infostealers.
Researchers tied over 1,200 sandbox analyses to these deceptive download pages, which use techniques ranging from sponsored search ads to hidden clipboard commands that trigger malicious PowerShell execution chains.
How to set a trap on computers
In one typical case involving a fake Claude page, the perpetrators would have anyone who clicked on the Windows download button copy a hidden command to their computer's clipboard, then show them instructions on how to execute it using official system tools.
Instead of the expected application, this command activated a process that downloaded files from the Internet and launched a chain of commands in the background. The analyses that were completed showed intense activity of programs that steal personal information and data.
Where do phishing pages appear?
Scammers promote their traps in a variety of ways, including paid search engine ads, legitimate web hosting services, shared AI chats, and deceptive file download sites.
READ ALSO
Man arrested for setting fire to synagogue in Kochi, drugs found at his home
Security firm ANY.RUN identified and linked 1.258 public analyses to similar fake AI campaigns between April and October 2026. Of the cases that could be linked to specific countries, businesses in the United States were targeted in 16% of cases.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)