ATTACKERS are fanning out fake AI campaigns across US companies by impersonating well-known AI services such as Claude, ChatGPT, GitHub Copilot and Gemini. The campaigns push malware through suspicious download pages, fraudulent authentication pages and sponsored search results, with victims tricked into installing or executing malicious components.
ANY[.]RUN’s interactive sandbox linked 1,258 public analyses to these fake AI campaigns between April and October 2026, and US targets accounted for about 16% of the incidents observed. The infection chain can unfold despite the initial lure appearing legitimate, because it relies on legitimate Windows utilities and proceeds through several execution stages before the payload activates.
In one representative attack, a Claude impersonation page mimics the official site and prompts a Windows download; clicking the button copies a command to the clipboard and instructs PowerShell execution. The command then launches mshta[.]exe to fetch a malicious HTA file and triggers an encoded PowerShell sequence, resulting in information-stealing activity.
The broader operational challenge for MSSPs is that initial indicators vary across customers, even though attacker behaviour remains similar, complicating detection, triage and threat hunting.
ANY[.]RUN reports that fake AI campaigns place sustained pressure on three SOC processes—monitoring/detection coverage, triage/escalation management, and threat hunting—while delivering concrete performance metrics: 16% of campaigns targeted the US, and sandbox-assisted investigations can yield 30% fewer Tier 1 to Tier 2 escalations, with a median detection time of 14 seconds and a 36% higher detection rate across looked-at threats.
The article outlines how MSSPs can improve Tier 1 efficiency, expand detection coverage through TI feeds with 99% unique IOCs, and reuse findings to scale responses across multiple clients.