Cybersecurity researchers have identified a widespread campaign where attackers impersonate popular artificial intelligence brands such as Perplexity, Claude, ChatGPT, and Copilot to distribute various forms of malware, including information stealers, backdoors, and malicious browser extensions. The findings are based on an analysis of 38 confirmed incidents over a 12-month period, from July 2025 to June 2026.
In 35 of these cases, the malicious activity directly targeted AI products, brands, or their associated ecosystems. Software impersonation was the most common tactic, accounting for 30 incidents. Claude was the most frequently impersonated brand, appearing in 26 cases.
Many incidents involved a technique dubbed "InstallFix," which mimics a legitimate software installation process. Unlike "ClickFix" attacks that simulate error or verification steps, InstallFix pages present detailed, step-by-step installation guides. These guides ultimately instruct users to copy and execute obfuscated commands, leading to malware infection. For instance, a fake Claude website was observed guiding a victim through an `mshta` command that retrieved a payload from a deceptive domain. The download was packaged as a Windows application, either `claude` or `claude.msixbundle`, which, upon execution, fetched code that ran in memory and attempted to compromise browser processes. Other variants included a booby-trapped `Claude Setup.zip` archive and a repackaged `claude.exe` acting as a malware loader.
Beyond direct software impersonation, attackers also leveraged malicious browser extensions. Several extensions posing as AI assistants, including one marketed as "AI Sidebar with DeepSeek, ChatGPT, Claude," were found to function as information stealers, communicating with command-and-control infrastructure. In one notable case, four customers installed a fake Perplexity extension distributed via the Chrome Web Store. This extension hijacked search queries, rerouted them through a lookalike domain, and transmitted browsing data to attacker infrastructure in real time. The extension had accumulated a 4.7-star rating from 67 reviews and claimed over 10,000 users, lending it an appearance of legitimacy.
The investigation also uncovered instances where attackers appeared to use AI for malware development. In one case involving a financial services organization, researchers identified a remote access Trojan (RAT) written in Rust that communicated via Slack. The malware was linked to a public GitHub repository whose commit history indicated collaboration between a human account and a Claude coding agent. This RAT was designed to poll a Slack channel for commands, with planned capabilities including command execution, file retrieval, configuration data downloads, persistence through scheduled tasks, and the potential to open a reverse shell. The development of this malware was tracked over several days through the repository's commit history.
Additionally, during a separate ransomware investigation, researchers observed potential signs of AI-generated code, characterized by unusually detailed comments and structured PowerShell code. However, these characteristics were considered circumstantial evidence and did not definitively confirm AI involvement in code generation.
Despite these findings, there is no evidence to suggest that AI is autonomously conducting attacks. The observed use of AI by attackers has been at the "lightest-touch end of the scale," primarily in generating code, with human operators remaining in control of the attack process. The most effective defenses against these impersonation tactics rely on conventional protections against malicious delivery and payload behaviors, rather than AI-specific characteristics. Users are strongly advised to install AI tools exclusively from confirmed vendor domains to mitigate risk.
