> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Fake AI, real malware: Attackers impersonating AI brands - URL: https://f4n6.co.uk/security-feed/fake-ai-real-malware-attackers-impersonating-ai-brands/ - Published: 2026-08-25T21:46:12.000Z - Updated: 2026-08-25T21:46:12.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Sophos X-Ops reviewed 86 MDR cases tagged for AI involvement between 2 July 2025 and 29 June 2026: 34 met its adversarial-AI taxonomy, with four additional investigations bringing the dataset to 38\. Thirty cases involved AI software impersonation; Claude was used as the lure in 26\. Observed outcomes included information stealers, backdoors, malicious browser extensions, credential phishing, web shells, a Slack-controlled RAT and, in one separate case, ransomware; one financial-services intrusion began with SQL injection against a bespoke PHP application outside MDR coverage. No authoritative CVSS score, severity or CISA KEV state was resolved for this item, and no actor attribution is confirmed; the evidence supports conventional, human-directed attacks using AI branding or AI-assisted development, not autonomous AI operations. ## 2\. Regulatory framing These mappings apply only where a client has the cited exposure; this advisory alone does not establish an incident-reporting obligation. | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk — general principles | Sophos observed execution of a poisoned LiteLLM PyPI package and a claude-mem npm plugin installed through NPX that fetched and ran remote GitHub code. | Where these dependencies or agentic developer tools form part of a regulated ICT service, record and assess their provenance, registry source and remote-code-fetch behaviour before continued use. | | NIS2 Art. 21(2)(d): supply chain security measures | Malicious code entered environments through public AI-development package ecosystems; whether a human or an AI agent initiated installation could not be established. | In-scope entities should include AI-agent dependencies in software-supply-chain controls, approved-registry policy and package-execution monitoring. | ## 3\. Technical analysis & attack chain The dataset covers several distinct intrusion paths. The following are source-confirmed observations, not one composite campaign or one actor’s kill chain. 1. **Search and advertising lures:** Victims searching for AI coding tools reached typosquatted sites through malicious advertisements or poisoned search results. InstallFix pages presented polished installation instructions; ClickFix variants used fake CAPTCHA or verification pages. 2. **User-driven Windows execution:** In one fake-Claude case, the victim ran an `mshta` one-liner that retrieved a Windows application package from `download-version[.]1-9-18[.]com`. The package was named `claude` or `claude.msixbundle`. A subsequent `irm | iex` command executed code in memory and attempted process hollowing against a browser process. The source does not provide the complete commands or confirm that hollowing succeeded. 3. **Installer payload branches:** Related infrastructure delivered LummaStealer through fake-CAPTCHA ClickFix. Other variants used `Claude Setup.zip` to stage a malicious `libcef.dll`, or supplied a repackaged `claude.exe` acting as a loader. A separate fake-Claude site used DLL sideloading to deploy a previously undocumented backdoor named Beagle; the supplied source does not describe Beagle’s commands, persistence or data-access capabilities. 4. **Malicious browser extensions:** Several extensions impersonated AI assistants, including one advertised as “AI Sidebar with DeepSeek, ChatGPT, Claude,” and functioned as information stealers with C2 communications. Four Sophos customers installed a fake Perplexity extension from the Chrome Web Store. It intercepted searches, redirected them through `perplexity-ai[.]online`, displayed a Tilda-hosted landing page and exfiltrated browsing telemetry in real time. Its listing showed a 4.7-star rating, 67 reviews and 10,000 installs. The observed data loss was browsing telemetry; theft of stored credentials or browser sessions was a capability risk, not a confirmed outcome for this extension. 5. **Other social-engineering routes:** Sophos observed AI-themed sites directing victims to run `finger.exe` from the Windows Run dialog; a fake Microsoft Copilot document share leading to the EvilProxy adversary-in-the-middle kit; OpenAI-branded credential harvesting; and a ChatGPT Atlas user induced to run an unspecified `curl` command that installed an information stealer. 6. **AI-development supply chain:** A poisoned LiteLLM PyPI package executed on one endpoint. In another case, a `claude-mem` npm plugin installed through NPX fetched and ran code from a remote GitHub repository. Execution was confirmed, but Sophos could not determine whether a human or an AI agent initiated either installation. No affected package versions or package hashes are supplied. 7. **Financial-services bespoke-application intrusion:** An attacker exploited SQL injection in a bespoke PHP application hosted on a device not enrolled in MDR. The attacker deployed web shells, ran discovery commands, attempted credential access and executed Chisel for TCP tunnelling before pivoting to MDR-protected endpoints. A custom Rust Windows RAT then polled a Slack channel for host-tagged commands. Repository artefacts described command execution, URL-based file downloads, retrieval of DPAPI-encrypted configuration, scheduled-task deployment and a reverse shell that was later removed during development. Internal strings were renamed from `rat-agent` to `svc`. The repository history showed a human account directing a Claude coding-agent account; this supports AI-assisted development, not autonomous operation. No Slack channel, token, scheduled-task name, port or configuration path was disclosed. 8. **Separate SonicWall SMA ransomware case:** Sophos reports initial access through a chain involving CVE-2026-15409 and CVE-2026-15410\. The operator connected from macOS and used Base64-encoded PowerShell; one script contained verbose, templated comments and another internal-discovery script contained Mandarin comments. Before ransomware deployment, the attacker tested write access with: ```cmd cmd.exe /C mkdir C:\test_enc & echo Hello World > C:\test_enc\test1.txt & echo Second file > C:\test_enc\test2.txt & echo {"data":"test"} > C:\test_enc\data.json & echo SQL dump > C:\test_enc\db.sql & echo backup data > C:\test_enc\backup.bak & echo This is a test document > C:\test_enc\readme.doc & echo email content > C:\test_enc\email.msg & dir C:\test_enc > C:\Windows\Temp\pMGiNNjc.tmp 2>&1 ``` The eventual ransomware encrypted its own extortion note. The ransomware family, encryption extension and demand were not reported. AI authorship remains circumstantial: detailed comments, command structure and a weak hostname/repository overlap do not prove that an LLM generated the tooling. No authoritative CVSS scores, severity classifications, affected versions, fixes or CISA KEV states were resolved for either CVE. No privilege-escalation technique was reported. Lateral movement was described only as a pivot from the unmanaged PHP host to protected endpoints. Confirmed data-access effects were browser telemetry exfiltration, credential-phishing exposure and information-stealer deployment; the source does not confirm exfiltration of financial or customer data. **Confidence caveat:** Case-level detail and the IOC dataset originate from Sophos. Help Net Security restates Sophos’s findings and is not independent technical corroboration. Except where Sophos itself references matching public reporting, the material is **single-sourced; verify before enforcement**. No named actor is reliably attributed, and no supporting MITRE actor profile was supplied. ## 4\. Mitigation & containment ### P1 — within 24 hours - Load the §5 hashes and defanged network indicators into SIEM, DNS, proxy, NDR and EDR hunting. Validate local observations before blocking because the set is single-sourced and includes compromised sites and infrastructure that may have changed. Isolate endpoints showing both IOC contact and suspicious execution. - Hunt for `mshta` retrieving from AI-themed infrastructure, `irm | iex`, browser-launched PowerShell, `finger.exe`, AI-lure-driven `curl`, browser process-hollowing attempts and execution of untrusted `.msixbundle` files. Block browser-to-script-interpreter execution where business policy permits. - Inventory managed Chromium extensions. Remove extensions contacting `perplexity-ai[.]online` or the Tilda landing page, overriding search behaviour, or failing publisher verification. Preserve the extension directory and browser telemetry before removal. Revoke browser sessions and reset exposed credentials where information-stealer execution or unauthorised session access is confirmed. - Quarantine files matching the supplied SHA-256 values. Treat the names `claude.exe`, `claude.msixbundle` and `libcef.dll` as hunt pivots only: names alone are insufficient because legitimate applications may use them. - For exposed SonicWall SMA deployments, determine immediately whether the installed build is affected by CVE-2026-15409 or CVE-2026-15410 and apply current vendor guidance. Restrict external access where operationally feasible pending assessment. This advisory provides no verified fixed version or CISA KEV state. - If a bespoke PHP application or otherwise unmanaged device is exposed, place it under EDR/MDR coverage or isolate it. Review application and WAF logs for SQL injection, web-shell creation, Chisel execution and connections to the listed Chisel infrastructure. ### P2 — within 72 hours - Search retained process, PowerShell, AMSI, DNS, proxy and browser-extension logs for all §5 indicators and §6 behaviours. Prioritise endpoints that ran `mshta`, PowerShell, `finger.exe` or `curl` shortly after visiting search advertisements or newly registered AI-themed domains. - Hunt for `C:\test_enc`, `C:\Windows\Temp\pMGiNNjc.tmp`, the dummy files in the command above, Base64-encoded PowerShell and internal network-discovery activity. - Review Slack audit and endpoint telemetry for unauthorised binaries repeatedly polling Slack from servers or unmanaged Windows devices. Investigate the supplied Slack-RAT hashes and unexpected Rust binaries; do not block Slack globally without validating business use. - Identify LiteLLM and `claude-mem` use in package manifests, lockfiles, CI/CD logs and developer-agent histories. Suspend unidentified or unpinned instances until package origin and integrity are established. Constrain NPX and agent-driven dependency execution to approved registries and repositories. - Remediate SQL injection in bespoke PHP applications through code correction, application-layer testing and WAF controls. Remove web shells, rotate credentials accessible to the compromised application and investigate Chisel-enabled access before returning the host to service. ### P3 — within 7 days - Restrict AI software acquisition to an internal catalogue or confirmed vendor domains. Block known typosquats and require signature, publisher and hash validation for installers. - Enforce an allowlist for browser extensions and alert on new search-provider overrides, broad browser permissions and extensions contacting non-vendor infrastructure. - Apply dependency pinning, approved registries, provenance review and remote-fetch controls to AI-agent and LLM packages. - Close EDR/MDR coverage gaps for developer workstations, legacy systems and bespoke web applications. Include these assets in application testing and exposure-management scope. - Update awareness material: users must not paste commands from software-installation pages, CAPTCHA prompts, advertisements or shared AI conversations into Run, PowerShell or a terminal. No affected package versions, vendor-fixed builds, registry remediation keys or SonicWall patch versions are present in the supplied material. ## 5\. Indicators of compromise The following indicators come from the SophosLabs dataset linked by the primary report. They are **single-sourced; verify before enforcement**. Infrastructure may be time-bound, and `as-kapital[.]com` and `util-locate[.]com` were described as compromised sites rather than necessarily attacker-owned infrastructure. | type | value | confidence | source | | -------- | ---------------------------------------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | domain | download-version\[.\]1-5-8\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | download-version\[.\]1-8-3\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | download-version\[.\]1-9-18\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | download-version\[.\]2-1-9\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | download\[.\]active-version\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | events\[.\]ms709\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | claude-setup\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | code\[.\]verification-claude-cdn\[.\]beer | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | finger\[.\]claudemo\[.\]net | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | claudefos\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | deepaichats\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | chatsaigpt\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | chataigpt\[.\]pro | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | chatgptsidebar\[.\]pro | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | chatgptbuddy\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | copilot\[.\]info | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | copilot\[.\]domains | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | openew\[.\]app | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | claudverification-id\[.\]beer | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | greenactiv\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | as-kapital\[.\]com | Medium — compromised site; single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | util-locate\[.\]com | Medium — compromised site; single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | perplexity-ai\[.\]online | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | url | hxxps://extension\[.\]tilda\[.\]ws/perplexityai | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | ipv4 | 144\[.\]172\[.\]102\[.\]171 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | ipv4 | 134\[.\]122\[.\]1\[.\]247 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | ipv4 | 5\[.\]181\[.\]3\[.\]142 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | ipv4 | 91\[.\]195\[.\]240\[.\]123 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | sha256 | 98d1f151872c27d0abae3887f7d6cb6e4ce29e99ad827cb077e1232bc4a69c00 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | sha256 | 20ba72e91d7685926c8c1c5b4646616fa9d769e32c1bc4e9f15dddaf3429cea7 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | claude-pro\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | license\[.\]claude-pro\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | get-mactech\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | mymachub\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | update-crowdstrike\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | domain | update-sentinelone\[.\]com | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | sha256 | 1cbcf213219a9c01de64354c836f77bfb70af5459e48bb947bd0b8011f67be35 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | sha256 | bed31c30a7c08e38f9c540bc87eb1bbcbddb5dc48f3bdcf011e2e6e8bb2f6051 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | sha256 | becb8d7d7b2c0dbce9e7d022bfe9948c030508f285e6d4b5c822bf034961a2fb | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | sha256 | ef9935cb14c0e3259d9d2a8b43b48c67e9bdf5cae12d9a26048a70e13cb3c698 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | sha256 | 62cdaecc867678720251b732cec0f2e845666f51d39d7cde064984bff3831c33 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | ipv4 | 185\[.\]193\[.\]66\[.\]120 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | ipv4 | 64\[.\]227\[.\]138\[.\]82 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | ipv4 | 129\[.\]212\[.\]225\[.\]220 | Medium — single source | [SophosLabs IOC CSV](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk) | | filepath | C:\\test\_enc | Medium — context-specific; single source | [Sophos report](https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands?ref=f4n6.co.uk) | | filepath | C:\\Windows\\Temp\\pMGiNNjc.tmp | Medium — context-specific; single source | [Sophos report](https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands?ref=f4n6.co.uk) | ```iocs domain download-version[.]1-5-8[.]com domain download-version[.]1-8-3[.]com domain download-version[.]1-9-18[.]com domain download-version[.]2-1-9[.]com domain download[.]active-version[.]com domain events[.]ms709[.]com domain claude-setup[.]com domain code[.]verification-claude-cdn[.]beer domain finger[.]claudemo[.]net domain claudefos[.]com domain deepaichats[.]com domain chatsaigpt[.]com domain chataigpt[.]pro domain chatgptsidebar[.]pro domain chatgptbuddy[.]com domain copilot[.]info domain copilot[.]domains domain openew[.]app domain claudverification-id[.]beer domain greenactiv[.]com domain as-kapital[.]com domain util-locate[.]com domain perplexity-ai[.]online url hxxps://extension[.]tilda[.]ws/perplexityai ipv4 144[.]172[.]102[.]171 ipv4 134[.]122[.]1[.]247 ipv4 5[.]181[.]3[.]142 ipv4 91[.]195[.]240[.]123 sha256 98d1f151872c27d0abae3887f7d6cb6e4ce29e99ad827cb077e1232bc4a69c00 sha256 20ba72e91d7685926c8c1c5b4646616fa9d769e32c1bc4e9f15dddaf3429cea7 domain claude-pro[.]com domain license[.]claude-pro[.]com domain get-mactech[.]com domain mymachub[.]com domain update-crowdstrike[.]com domain update-sentinelone[.]com sha256 1cbcf213219a9c01de64354c836f77bfb70af5459e48bb947bd0b8011f67be35 sha256 bed31c30a7c08e38f9c540bc87eb1bbcbddb5dc48f3bdcf011e2e6e8bb2f6051 sha256 becb8d7d7b2c0dbce9e7d022bfe9948c030508f285e6d4b5c822bf034961a2fb sha256 ef9935cb14c0e3259d9d2a8b43b48c67e9bdf5cae12d9a26048a70e13cb3c698 sha256 62cdaecc867678720251b732cec0f2e845666f51d39d7cde064984bff3831c33 ipv4 185[.]193[.]66[.]120 ipv4 64[.]227[.]138[.]82 ipv4 129[.]212[.]225[.]220 filepath C:\test_enc filepath C:\Windows\Temp\pMGiNNjc.tmp ``` ### Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ----------------------------------------------- | | Search advertisement or poisoned result leads to an AI-brand typosquat, followed by instructions to paste a command | Secure web gateway, browser history, DNS and advertisement-referrer telemetry | Medium — single source | | mshta retrieves an AI-branded installer; PowerShell then uses irm \\\| iex | EDR process creation, PowerShell and AMSI logs | Medium — single source | | Browser process-hollowing attempt after fake-Claude package execution | EDR memory, thread and process-injection telemetry | Medium — single source | | Extension intercepts searches, redirects through non-vendor infrastructure and sends browsing telemetry in real time | Browser-extension inventory, proxy and DNS logs | Medium — source-reported | | SQL injection against bespoke PHP application followed by web shells and Chisel | WAF, web-server, PHP, EDR and network logs | Medium — single source | | Unauthorised Rust Windows binary polls Slack for host-tagged commands | EDR, proxy and Slack audit logs | Medium — single source | | Creation of C:\\test\_enc dummy files followed by output to pMGiNNjc.tmp | Process, command-line and filesystem telemetry | Medium — single source | | NPX-installed claude-mem retrieves and executes code from GitHub | Shell history, CI/CD, package-manager and proxy logs | Medium — execution confirmed; initiator unknown | ## 6\. Detection For Sophos-managed estates, the source lists these countermeasures: - Delivery and execution: `Mal/HTMLGen-A`, `WIN-EVA-PRC-MSHTA-HTTP`, `WIN-EXE-PSH-SUSP-IEX-1`, `WIN-PROT-BEHAVIORAL-MALWARE-EXEC-19C-T1218-005`, `WIN-PROT-AMSI-AMSI-PROTECTION-AMSI-PSDLR-G`, `WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1`. - Payload, C2 and access: `Troj/Beagldr-A`, `ATK/DonutLdr-B`, `OSX/InfoStl-FQ`, `WIN-PROT-BEHAVIORAL-MALWARE-C2-10A-T1071-001`, `Troj/RAT-NG`, `Troj/WebShel-BU`, `Troj/WebShel-KB`, `PHP/WebShell-CD`, `ATK/Chisel-F`, `WIN-PROT-VDL-MALWARE-ATK-CHISEL-F`, `WIN-CRD-PRC-PSQL-SUSP-VEEAMBACKUP-1`. The following YARA rule targets the distinctive pre-encryption write-test command. It detects scripts or tooling containing the artefacts; it does not establish a ransomware-family attribution. ```yara rule AT_2026_08_PreEncryption_Write_Test_Artifacts { meta: author = "Adverse Trace" date = "2026-08-25" reference = "https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands" description = "Detects file-path strings from the observed pre-encryption write-access test" strings: $file1 = "C:\\test_enc\\test1.txt" ascii wide $file2 = "C:\\test_enc\\test2.txt" ascii wide $file3 = "C:\\test_enc\\data.json" ascii wide $file4 = "C:\\test_enc\\db.sql" ascii wide $file5 = "C:\\test_enc\\backup.bak" ascii wide $file6 = "C:\\test_enc\\readme.doc" ascii wide $file7 = "C:\\test_enc\\email.msg" ascii wide $tmp = "C:\\Windows\\Temp\\pMGiNNjc.tmp" ascii wide condition: $tmp and 3 of ($file*) } ``` ```yaml title: AI-Branded InstallFix and ClickFix Command Execution status: experimental description: Detects command-line combinations reported in fake AI installer and social-engineering cases. author: Adverse Trace date: 2026-08-25 references: - https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands logsource: category: process_creation product: windows detection: selection_mshta: CommandLine|contains|all: - 'mshta' - 'download-version.1-9-18.com' selection_irm_iex: CommandLine|contains|all: - 'irm ' - '| iex' selection_finger: CommandLine|contains|all: - 'finger.exe' - 'finger.claudemo.net' condition: selection_mshta or selection_irm_iex or selection_finger falsepositives: - Legitimate administrative use of irm and iex; validate parent process, user context and destination. level: medium ``` ```yaml title: Observed Pre-Encryption Write-Access Test status: experimental description: Detects the exact directory and temporary-file artefacts used before ransomware deployment. author: Adverse Trace date: 2026-08-25 references: - https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'cmd.exe /C mkdir C:\test_enc' - 'C:\test_enc\db.sql' - 'C:\test_enc\backup.bak' - 'C:\Windows\Temp\pMGiNNjc.tmp' condition: selection falsepositives: - Security testing that intentionally reproduces the published command. level: high ``` The source provides no exact Slack channel, scheduled-task name, service, registry key, browser-extension identifier or malicious package version. Rules based on those fields cannot be authored without fabrication. ## 7\. Sources - Sophos X-Ops, [Fake AI, real malware: Attackers impersonating AI brands](https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands?ref=f4n6.co.uk), 19 August 2026. - Help Net Security, [Attackers impersonate popular AI brands to spread malware](https://www.helpnetsecurity.com/2026/08/21/ai-brand-impersonation-malware-malware-research/?ref=f4n6.co.uk), 21 August 2026. - SophosLabs, [AI\_2025-2026\_IOCs.csv](https://github.com/sophoslabs/IoCs/blob/master/AI%5F2025-2026%5FIOCs.csv?ref=f4n6.co.uk), accessed 25 August 2026. ## 8\. Adverse Trace position Adverse Trace assigns no formal CVE-based severity because no authoritative CVSS scores, severity classifications or CISA KEV states were resolved for this item. The client impact can nevertheless be material where users install unverified AI tooling, browser extensions intercept regulated browsing activity, developer agents execute uncontrolled dependencies, or bespoke applications remain outside monitoring coverage. Confirmed compromise warrants P1 containment, but the reporting does not support treating all AI software or AI-agent use as malicious, nor does it establish autonomous attack execution. No named-actor attribution is confirmed. Most technical detail and the IOC set are **single-sourced; verify before enforcement**. Adverse Trace will monitor for independent corroboration, affected package versions, extension identifiers, SonicWall remediation data, IOC changes and defensible actor attribution. --- [Read the original source →](https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*