Originally published on satyamrastogi.com

Campaigns impersonating Claude and ChatGPT are escalating with ClickFix-style social engineering. We analyze the attack chain, delivery mechanisms, and detection gaps threatening developer populations.

---

Fake Claude/ChatGPT Campaigns: ClickFix Social Engineering at Scale

Executive Summary

We are observing a significant uptick in phishing campaigns that impersonate Anthropic's Claude and OpenAI's ChatGPT platforms. These attacks follow the ClickFix social engineering playbook: victims receive messages claiming account compromise or suspicious activity, then redirected to fake login pages or fake "update" installers. The target demographic is enterprise developers and engineers who actively use these tools for productivity, making them high-value vectors for initial compromise.

From an offensive perspective, this campaign family represents near-perfect attack geometry. The threat actors exploit several psychological and operational vulnerabilities:

1. Developer populations operate with elevated system privileges
2. AI tools are industry-standard, creating reduced skepticism
3. Urgency messaging ("account locked", "suspicious login") bypasses rational analysis
4. Installation workflows bypass traditional email gateway inspection

The payload delivery has evolved beyond basic malware droppers. Recent variants correlate with Claude Code Desktop 'SneakPeek' Zero-Click credential extraction techniques, suggesting coordination between multiple threat actor clusters or shared tooling infrastructure.

Attack Vector Analysis

Initial Access and Social Engineering

The campaign uses multi-channel delivery:

• Compromised LinkedIn profiles recommending fake Claude/ChatGPT browser extensions
• Phishing emails mimicking official platform notifications ("Security Alert: Unusual Activity Detected")
• Malicious GitHub repositories posing as legitimate SDK updates
• Discord messages in developer communities linking to fake download portals
• SMS/Slack notifications targeting mobile access patterns

This aligns with MITRE ATT&CK T1566 (Phishing) and T1598 (Phishing for Information). The sophisticated targeting suggests reconnaissance of victim organizations' tech stacks through job postings, GitHub profiles, and conference registrations.

ClickFix Mechanics and Payload Delivery

ClickFix attacks follow this sequence:

1. Social Engineering Hook: "Your Claude account detected unauthorized access from China (IP: 203.x.x.x). CLICK HERE TO SECURE."
2. Redirect Chain: Victim clicks -> URL shortener -> attacker infrastructure -> fake login page or malware host
3. Credential Harvesting OR Malware Installation: Two parallel tracks:
   • Track A: HTML5 forms capturing emails/passwords for lateral movement
   • Track B: Fake "Update Required" prompts delivering ClickFix payloads (MSI/DMG/DEB installers)

ClickFix malware traditionally executes in the context of existing processes, leveraging T1218 (System Binary Proxy Execution). Recent variants observed in this campaign add post-exploitation modules:

# Pseudo-code representation of observed payload staging
if (payload_execution_success):
 enumerate_browser_credentials() # Extract saved passwords
 enumerate_ssh_keys() # Check ~/.ssh/
 enumerate_git_credentials() # .git-credentials, SSH config
 enumerate_api_tokens() # Environment vars, .bashrc, config files
 enumerate_cloud_credentials() # AWS, Azure, GCP credentials
 exfiltrate_to_c2(collected_data)
 persist_via_scheduled_task()
 spawn_reverse_shell()

This represents T1555 (Credentials from Password Stores), T1552 (Unsecured Credentials), and T1547 (Boot or Logon Autostart Execution).

Brand Impersonation Sophistication

Threat actors maintain domains and infrastructure with high fidelity:

• claude-secure-verify[.]com (typosquatter)
• chatgpt-account-alert[.]cloud (subdomain spoofing pattern)
• claude-update-now[.]app (urgency-driven naming)
• Fake SSL certificates from Let's Encrypt (trivial to obtain)
• Cloned web interfaces using browser developer tools and screenshot parsing

Certificate transparency logs show rapid deployment: certificate issuance to first phishing email typically 4-6 hours, suggesting automation or pre-staged infrastructure.

Technical Deep Dive

Credential Extraction Techniques

Post-compromise, the payloads target developer-specific credential stores:

# Targets from observed malware telemetry

# Browser credential vaults
ls -la ~/.config/google-chrome/Default/
ls -la ~/Library/Application\ Support/Google/Chrome/Default/
sqlite3 ~/.config/google-chrome/Default/Login\ Data "SELECT username_value, password_value FROM logins;"

# Git credentials and SSH keys
cat ~/.git-credentials
cat ~/.ssh/id_rsa
cat ~/.ssh/id_ed25519
grep -r "privatekey" ~/.ssh/

# API token patterns in shell history
grep -r "sk-" ~/.* # OpenAI API keys
grep -r "AKIA" ~/.* # AWS access keys
grep -r "ghp_" ~/.* # GitHub personal access tokens
grep -r "glpat-" ~/.* # GitLab tokens

# Environment variable enumeration
env | grep -E "(API|KEY|TOKEN|SECRET|PASS|CREDENTIAL)"
grep -r "export.*API" ~/.*rc

# Docker/container credentials
cat ~/.docker/config.json
cat ~/.kube/config

The payloads also enumerate running processes to identify active development environments:

ps aux | grep -E "(vscode|idea|eclipse|xcode|netbeans)"
ls -la ~/.vscode/extensions/
cat ~/.vscode/extensions.json # IDE extensions often include auth tokens

Supply Chain Weaponization

A subset of these campaigns targets developers with the specific goal of compromising downstream artifacts:

• NPM/PyPI poisoning: Stolen credentials used to publish backdoored package versions
• GitHub Actions workflows: Malicious code injection into CI/CD pipelines
• Container registry compromise: Private Docker registries accessed via harvested credentials
• Infrastructure-as-Code templates: Terraform/CloudFormation templates modified to include persistence

This represents T1195.002 (Compromised Software Supply Chain) and creates cascading compromise potential across enterprise customer bases.

Detection Strategies

Network Layer

1. Domain Reputation Analysis

   • Monitor for lookups to domains registered within 7 days of campaign launch
   • Flag typosquatter domains (Levenshtein distance analysis on DNS queries)
   • Correlate with WHOIS registrant patterns (bulk registrations, privacy services)
   • Query PassiveDNS datasets against known C2 infrastructure

2. TLS Certificate Monitoring

   • Ingest Certificate Transparency logs for certificates matching Claude/ChatGPT patterns
   • Alert on certificates issued to domains 72 hours before first phishing email (indicates staging)
   • Flag certificates with mismatched organizational fields

3. Egress Traffic Inspection

   • Monitor for exfiltration of Git credentials (SSH keys, .git-credentials files)
   • Alert on unusual API token transmission patterns (tokens appearing in HTTP headers to non-Anthropic/OpenAI domains)
   • Flag large credential store file transfers via network inspection

Endpoint Layer

1. Process Execution Monitoring

   • Alert on child processes spawned by browser/IDE processes executing credential enumeration commands
   • Monitor for process hollowing or injection into legitimate developer tools
   • Flag execution of sqlite3 against Chrome/Firefox credential databases
   • Detect SSH private key enumeration via file access monitoring

2. File System Monitoring

   • Alert on access to ~/.ssh/, ~/.kube/, ~/.docker/, and IDE credential directories outside expected processes
   • Monitor for bulk exfiltration of files matching credential patterns (*_rsa*, *.pem, *credentials*)
   • Flag creation of new scheduled tasks or cron jobs in developer user contexts

3. Memory Forensics

   • Scan process memory for plaintext API tokens, SSH keys, and passwords (post-extraction)
   • Monitor for credential dumping tool indicators (mimikatz, pypykatz execution patterns)

Application Layer

1. User Behavior Analytics

   • Establish baseline: when developers typically access Claude/ChatGPT, from which IP ranges
   • Alert on login attempts from new geographies or IPs for developer accounts
   • Monitor for multiple failed login attempts followed by immediate successful compromise from different IP
   • Track unusual API usage patterns (bulk data downloads, non-standard endpoint access)

2. Authentication Indicators

   • Review OAuth token usage logs for new device fingerprints
   • Monitor for tokens used from both company network and external malicious IP simultaneously
   • Alert on API key rotation events preceded by credential harvesting signals

Mitigation and Hardening

Developer Environment Hardening

1. Credential Management

   • Enforce hardware security key authentication for all developer accounts (FIDO2, WebAuthn)
   • Require SSH keys with passphrase protection and age-based rotation
   • Implement credential manager deployment (1Password Teams, Bitwarden Organization, Dashlane) to centralize and monitor credential access
   • Audit SSH agent configurations; disable SSH agent forwarding unless absolutely necessary

2. Process Isolation

   • Deploy browser sandboxing (Chromium with --enable-sandbox forced, Firejail for Linux developers)
   • Containerize development environments to isolate credential stores from host OS
   • Implement application whitelisting on developer workstations
   • Use mandatory integrity levels (MIL) on Windows to prevent process injection into elevated contexts

3. IDE and Tool Hardening

   • Disable auto-save of authentication credentials in IDE configurations
   • Restrict IDE extension marketplace to pre-approved, internally hosted packages
   • Implement IDE plugin scanning for credential exfiltration (SCA tools scanned plugins)
   • Enforce environment variable encryption for API keys in IDE launch configurations

Organizational Controls

1. Email Gateway and Web Filtering

   • Deploy contextual defense systems that correlate phishing emails with brand impersonation indicators
   • Configure DMARC/SPF/DKIM for Anthropic and OpenAI sending domains; alert on spoofing attempts
   • Implement URL filtering with zero-trust model: require click confirmation for newly registered domains
   • Block known ClickFix payload domains via EDR feed integration

2. API Token Management

   • Implement short-lived API tokens (15-30 minute expiration) for development environments
   • Rotate API tokens automatically and log all rotation events
   • Use scoped API tokens restricted to minimal required permissions
   • Monitor API token usage; correlate with SSH key access for anomaly detection

3. Supply Chain Monitoring

   • Scan published packages for markers of credential harvesting (process enumeration, file system scanning)
   • Implement package signing requirements and verify signatures before installation
   • Monitor for sudden package version updates; compare against official release schedules
   • Implement registry proxying (Artifactory, Nexus) with content analysis before package availability

Threat Intelligence Integration

• Subscribe to domain registration feeds tracking typosquatter patterns for high-value brands
• Correlate observed ClickFix campaigns with other AI-related attack chains
• Share credential exfiltration indicators with CISA and industry ISACs
• Track threat actor infrastructure reuse patterns (C2 domains, hosting providers, payment processors)

Key Takeaways

• Developer targeting via AI brand impersonation represents evolved social engineering; success rates exceed commodity phishing due to high urgency and platform legitimacy
• Post-exploitation focuses on credential harvesting for supply chain compromise, not traditional endpoint objectives
• ClickFix variants now include sophisticated credential enumeration targeting Git, SSH, Docker, and cloud API tokens
• Endpoint detection must focus on process-level credential access patterns and file system exfiltration of secrets
• Hardware security keys and credential isolation are essential mitigations; traditional EDR alone is insufficient

Related Articles

• Claude Code Desktop 'SneakPeek' Zero-Click: Silent Credential Extraction
• CikaBika Bot RAT: Discord C&C Infrastructure & Phishing Delivery
• Contextual Defense: Connecting Attack Signals Before Escalation

External References

• MITRE ATT&CK T1566: Phishing
• MITRE ATT&CK T1555: Credentials from Password Stores
• NIST Cybersecurity Framework: Phishing Prevention
• OWASP Security Awareness
• CISA Phishing and BEC Prevention