The Internet is littered with convincing counterfeit AI offerings that, instead of providing popular tools, drop infostealers, remote access Trojans (RATs), and other threats inside enterprise networks.
In a report this week, Any.Run researchers examined threat campaigns that use AI-themed lures that impersonate leading brands such as Claude, ChatGPT, and others. Over a six-month period, a full 1,258 incidents analyzed on the firm’s platform traced back to fake AI tool attacks.
The lures were presented in a variety of ways, from SEO poisoning and malicious ads to fake download pages and AI-themed artifacts. The campaigns most often impersonated Anthropic’s Claude, with 60% of the analyses, and OpenAI’s ChatGPT and Codex representing 33% of the analyses. Any.Run researchers also found the attacks frequently used a familiar tactic.
“The attacks share one trait: the employee performs the decisive step. They paste an ‘install command,’ run a convincing installer, or sign in to a fake window,” the report stated. “That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations.”
The 1,258 analyses indicate these types of attacks are on the rise, according to Any.Run’s research team.
“This number alone shows how widespread the problem has become, especially considering that security teams from over 16,000 companies worldwide use Any.Run to investigate suspicious activity,” a research team spokesperson tells Dark Reading. “While it’s impossible to confirm the exact number of infections, the data suggests these campaigns reached a significant number of users.”
ClickFix, InstallFix & AI-Themed Lures
Any.Run’s report showed that ClickFix-type tactics made up nearly half of the AI-themed campaigns it studied. Fake command-line interface (CLI) installers or InstallFix attacks represented 27% of the analyses, while traditional ClickFix attacks that began with fake download pages accounted for 17%. Meanwhile, attack chains that began with abused AI chats or malicious artifacts represented 25%.
“Fake AI and ClickFix are closely connected,” the Any.Run spokesperson says, highlighting that 45% of the analyses involved the threat actor asking a victim to copy and paste a command into their interface. “This shows how widely attackers are already combining AI-themed lures with ClickFix techniques.”
The lures typically offer fake CLI installers for various AI tools on GitHub pages or copied documentation hosted on trusted platforms such as Cloudflare Pages, GitLab Pages, Google Sites, GitHub, or even the AI platforms themselves, primarily targeting developers. Meanwhile, fake ads and SEO poisoned search results are usually aimed at marketing personnel.
“We expect fake AI lures to become even more common as new AI tools continue to launch and public interest remains high,” the research team says. “People often search for installation instructions without knowing which sources to trust, and attackers take advantage of this.”
AI-themed InstallFix and ClickFix variants are designed to compromise developer workstations to obtain a target organization’s source code, SSH keys, CI/CD tokens, and cloud and AI API keys. “This approach is particularly effective against developers, since installing legitimate AI coding tools often involves running terminal commands,” the spokesperson says. “That makes malicious instructions easier to disguise as normal installation steps.”
And while marketing professionals may be less attractive targets for threat actors, Any.Run warned that those attacks could compromise credentials for high-value business accounts.
Risky Artifacts & AI Chats
In addition to increasingly prevalent InstallFix and ClickFick attacks, other types of AI-themed threats are also gaining steam. For example, a technique known as “LLMshare” has proven quite effective, according to Push Security.
LLMShare involves threat actors creating content on AI platforms in shared chats that often appear to offer installation guidance and service updates that contain malware, using malvertising and SEO poisoning to drive traffic to the malicious chats. Shared artifacts follow a similar track, as the attackers publish the malicious content directly to the AI platforms.
“The recent variants using shared chats, artifacts, and most recently custom GPTs are particularly nasty,” Dan Green, researcher at Push Security, tells Dark Reading. These are legitimate AI sites (it’s the real Claude, ChatGPT, etc. domain), and so people don’t expect to be served a malicious link there.
Green adds that, like InstallFix, LLMshare has proven to be very effective, because it takes advantage of “very normal interactions and behaviors online” in today’s era of rapid AI adoption. In fact, AI-themed InstallFix attacks make up 5% to 10% of Push Security’s monthly detections, and the number is growing every month.
“Today, everyone is encouraged to use AI tools, and many are legitimately installed via the command line,” Green says. “You have regular users working more like developers, making it easy for attackers to manipulate them.”
Any.Run researchers emphasized that because many of these attacks are using legitimate domains and are sometimes hosted directly on the very AI platforms they’re trying to use, detection can be challenging. But there are ways to mitigate the threat, starting with employee behavior.
“Every pattern in this research starts with an employee looking for an AI tool on their own,” the report stated. “Publish a short list of approved AI tools with their official sources (vendor site, winget, Homebrew, or the vendor’s package) and install them through MDM or the software portal.”
Any.Run researchers also recommended that security teams restrict standard users’ ability to paste and run commands, while also training employees to always verify install commands against a vendor’s official documentation rather than relying on third-party links, ads, shared chats, or other sources.
