Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early

Summary: Attackers are impersonating AI products including Claude, ChatGPT, GitHub Copilot, and Gemini to distribute malware, steal browser sessions, and compromise business accounts, with ANY.RUN linking 1,258 public sandbox analyses to fake AI campaigns between April and October 2026. One analyzed campaign mimicking the Claude download page copies a command to the clipboard that launches mshta.exe, retrieves a malicious HTA file, and triggers an encoded PowerShell chain, while US businesses accounted for 16% of country-attributed targets.
What's compelling: The attack runs on legitimate Windows utilities and starts with an employee voluntarily following installation instructions, so the payload only appears after several execution stages - meaning the initial indicators vary across customers while the underlying behavior stays the same, and MSSPs must recognize it across environments with different technologies, policies, and risk profiles.

Read the original at The Hacker News ↗