CAMPAIGNS impersonating Claude, ChatGPT and other AI brands are on the rise, with Any[.]Run researchers recording 1,258 incidents analysed over six months that traced back to fake AI tool attacks. The lures take forms such as SEO poisoning, malicious ads and fake download pages, often using familiar AI-themed artefacts to entice users.
The campaigns frequently rely on a decisive user action—pasting an install command, running a convincing installer or signing into a fake window—which can expose source code, cloud and AI API keys, active business sessions, ad accounts and billing access. In practice, a single user action can lead to data exposure, account compromise, financial loss or disruption to development and marketing operations.
The report highlights ClickFix- and InstallFix-style techniques as dominant, with ClickFix-like campaigns making up about half of those studied, and InstallFix accounting for about 27%. Attack chains also begin with abused AI chats or artefacts in about a quarter of cases. The attackers often host fake CLI installers on GitHub pages or documentation on trusted platforms, and some campaigns use malvertising and shared AI chats or artefacts—sometimes on legitimate AI sites—making detection challenging.
Developers and marketing staff are particularly at risk, as many attacks rely on normal deployment flows, such as command-line installations.
Recommendations focus on governance and user behaviour: publish a short list of approved AI tools with official sources and install them through a central management system, restrict standard users from pasting or running commands, and require verification of install commands against vendor documentation rather than third-party links or shared chats. The researchers emphasise training and verification to curb trust in seemingly legitimate sources.