On October 15, 2026, The Hacker News published a contributed article from the security vendor ANY.RUN describing a growing wave of fake AI campaigns. According to the vendor, attackers impersonate well-known AI products, including Claude, ChatGPT, GitHub Copilot and Gemini, to get people to install malware on their own machines. ANY.RUN says it linked 1,258 public sandbox analyses to these campaigns between April and October 2026, and that US businesses made up 16% of the targets it could attribute to a country. These are the vendor's own figures from its own submissions, not independently verified; see the caveats below.
Nothing about the technique is advanced. The attacker does not break into anything. An employee looking for an AI tool lands on a convincing page and runs a command they were told to run.
That is the part leaders should focus on. Your staff are being encouraged to adopt AI tools, and attackers are standing at the front door of that adoption.
The short answer
Fake AI download and login pages are being used to deliver infostealers through sponsored search results, legitimate hosting services, shared AI conversations and counterfeit download sites. The user starts the infection, and the chain uses built-in Windows tools, so it can slip past tools that only look for known bad domains. The fix is a mix of approved AI tooling that employees can find easily, controls on what a laptop can run, and detection based on behavior.
Key takeaways
- Attackers copy the look of AI product pages, then ask the user to run a command or enter credentials.
- The article's text describes a Claude-themed download page (a figure caption says Copilot, so lure details may vary) that copies a PowerShell command to the clipboard and tells the user to run it.
- The chain launches a legitimate Windows utility, then an encoded PowerShell stage, and completed analyses showed infostealer activity.
- Domains, hosting and AI brands rotate, so a blocklist of known domains misses new variants.
- The people most at risk are the ones you want using AI: engineers, analysts and anyone with access to company data.
What the article reports
The campaigns share a pattern. A victim lands on a page that looks like an official AI product site, through a paid search ad, a shared AI conversation or a lookalike domain. In the Claude-themed example, clicking the Windows download button does not download a file. It copies a command to the clipboard and shows instructions to paste it into PowerShell.
The command starts mshta.exe, a legitimate Windows component, which fetches a malicious HTA file. An encoded PowerShell chain follows. Analyses that ran to completion showed infostealer behavior, meaning software that collects saved passwords, browser sessions and similar data.
ANY.RUN lists behaviors that recur across the campaigns:
- Suspicious PowerShell installation commands.
mshta.exeexecution.- Encoded download instructions.
- Scheduled tasks that launch browsers for session theft.
What to treat with caution
This is a vendor-contributed article, and its source is a company that sells sandbox and threat intelligence products. A few points are worth keeping in mind:
- The campaign counts and the 16% US share come from ANY.RUN's own public sandbox data. They show what its users submitted, not the full scale of the problem.
- The article includes performance claims for ANY.RUN's products, such as fewer escalations and faster detection. We have not verified them, and we do not repeat them here.
- The article does not name victim companies, and it does not say how many infections succeeded.
- A figure caption refers to a fake Copilot installation page while the text describes a Claude example, so the details of individual lures may vary.
The underlying risk is still credible. Infostealers delivered through fake software pages are a well-established attack, and AI brands are an attractive disguise right now.
Why this is a leadership problem
- The user does the work. Because the employee pastes and runs the command, there may be no malicious attachment or download for email and file filters to inspect (our inference, not a claim from the article; later stages are fetched over the network, so proxies and endpoint detection can still see them). Training helps, but it will not catch everyone.
- Stolen sessions skip your sign-in controls. An infostealer that takes browser sessions can give an attacker access to cloud consoles, code repositories and SaaS tools without a password prompt. Multi-factor authentication does not help if the session is already authenticated.
- Shadow AI makes it worse. If people cannot easily find an approved AI tool, they search for one. The fake page is waiting at the top of the results.
- One laptop can hold many keys. Developer machines often contain cloud credentials, API tokens and repository access. One infection can reach production.
Eight actions for this month
| # | Ask your team to... | What done looks like |
|---|---|---|
| 1 | Publish an approved list of AI tools with official download and sign-in links | One page employees can find in under a minute, linked from onboarding and the intranet |
| 2 | Tell staff never to paste commands from a web page into a terminal | A short rule in your security guidance, with the fake download example as the illustration |
| 3 | Restrict mshta.exe and tighten PowerShell on managed devices |
mshta.exe blocked where not needed (AppLocker/WDAC or an attack surface reduction rule); PowerShell script block logging on everywhere, and Constrained Language Mode for staff who do not need full PowerShell. Test with engineering first so tooling is not broken |
| 4 | Detect on behavior, not only known domains | Alerts for encoded PowerShell, mshta.exe launching network connections, and new scheduled tasks that start browsers |
| 5 | Shorten the life of browser and cloud sessions | Session lifetimes reviewed for admin tools, code hosting and cloud consoles; device-bound sessions where available |
| 6 | Keep long-lived secrets off laptops | Credentials in a secrets manager or short-lived tokens, not in dotfiles, config files or local .env files |
| 7 | Prepare a response for a suspected infostealer infection | A runbook that isolates the device, revokes sessions and rotates every credential the user could reach |
| 8 | Run a tabletop exercise on a fake-AI-page infection and report the results | A one-page report: the time taken to isolate the device and revoke sessions, the number of managed devices with mshta.exe blocked, and the fixes assigned, ready to show a customer, auditor or board |
Questions to ask this week
- Where would an employee go today to get an approved AI assistant, and is it easier than searching?
- Can our laptops run PowerShell commands pasted from the internet, and would we notice?
- If an infostealer ran on an engineer's laptop tonight, which credentials and sessions would be exposed?
- How quickly could we revoke all of one person's sessions and tokens?
- Do we monitor for behavior, or only for domains on a list?
What to measure
- Share of employees with a working path to an approved AI tool.
- Share of managed devices where unneeded script hosts are restricted.
- Time from a suspected infection to revoked sessions and rotated credentials in your last exercise.
- Number of long-lived secrets found on developer machines, and how many were moved or removed.
The post on who owns security at a startup is useful if nobody currently owns these controls, and the CERT-In advisory on exposed credentials covers what an attacker can do with the secrets an infostealer collects.
Where tooling helps
Most of the work here is endpoint and identity hygiene, which sits outside a code scanner. Where Orbis AppSec fits is the secrets side: scanning repositories and history for exposed credentials and vulnerable code, and opening fix pull requests for your team to review, so a stolen laptop does not hand over keys that were never needed in code. If you would like to try it on your own repositories with our team, see our design partner program.
Frequently asked questions
Is this a flaw in Claude, ChatGPT, Copilot or Gemini? No. The campaigns copy the look of these products. The real products are not compromised in the cases described.
Why does the attack use PowerShell and mshta.exe? They are legitimate Windows tools, so their use can look normal and may not trigger tools that only block known malicious files.
Will security awareness training stop this? It helps, but the pages are convincing. Pair training with technical controls and an easy approved route to the real tools.
Does multi-factor authentication protect us? It protects the sign-in. An infostealer that takes an already authenticated browser session can bypass it, so session length and device checks matter too.
Are these numbers reliable? They are vendor-reported figures from public sandbox submissions. Treat them as a signal about the trend, not a measure of total scale.
What is the single most useful step? Give people an approved AI tool they can find easily, and tell them never to paste commands from a web page into a terminal.
Sources and further reading
- The Hacker News, October 15, 2026: Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
This guide is general guidance based on a contributed vendor article dated October 15, 2026. Statistics are the vendor's and have not been independently verified. Use security tools only in environments you are authorized to test.