Fake AI, real malware: Attackers impersonating AI brands

1. Executive summary

Sophos X-Ops reviewed 86 MDR cases tagged for AI involvement between 2 July 2025 and 29 June 2026: 34 met its adversarial-AI taxonomy, with four additional investigations bringing the dataset to 38. Thirty cases involved AI software impersonation; Claude was used as the lure in 26. Observed outcomes included information stealers, backdoors, malicious browser extensions, credential phishing, web shells, a Slack-controlled RAT and, in one separate case, ransomware; one financial-services intrusion began with SQL injection against a bespoke PHP application outside MDR coverage. No authoritative CVSS score, severity or CISA KEV state was resolved for this item, and no actor attribution is confirmed; the evidence supports conventional, human-directed attacks using AI branding or AI-assisted development, not autonomous AI operations.

2. Regulatory framing

These mappings apply only where a client has the cited exposure; this advisory alone does not establish an incident-reporting obligation.

3. Technical analysis & attack chain

The dataset covers several distinct intrusion paths. The following are source-confirmed observations, not one composite campaign or one actor’s kill chain.

1. Search and advertising lures: Victims searching for AI coding tools reached typosquatted sites through malicious advertisements or poisoned search results. InstallFix pages presented polished installation instructions; ClickFix variants used fake CAPTCHA or verification pages.
2. User-driven Windows execution: In one fake-Claude case, the victim ran an mshta one-liner that retrieved a Windows application package from download-version[.]1-9-18[.]com. The package was named claude or claude.msixbundle. A subsequent irm <url> | iex command executed code in memory and attempted process hollowing against a browser process. The source does not provide the complete commands or confirm that hollowing succeeded.
3. Installer payload branches: Related infrastructure delivered LummaStealer through fake-CAPTCHA ClickFix. Other variants used Claude Setup.zip to stage a malicious libcef.dll, or supplied a repackaged claude.exe acting as a loader. A separate fake-Claude site used DLL sideloading to deploy a previously undocumented backdoor named Beagle; the supplied source does not describe Beagle’s commands, persistence or data-access capabilities.
4. Malicious browser extensions: Several extensions impersonated AI assistants, including one advertised as “AI Sidebar with DeepSeek, ChatGPT, Claude,” and functioned as information stealers with C2 communications. Four Sophos customers installed a fake Perplexity extension from the Chrome Web Store. It intercepted searches, redirected them through perplexity-ai[.]online, displayed a Tilda-hosted landing page and exfiltrated browsing telemetry in real time. Its listing showed a 4.7-star rating, 67 reviews and 10,000 installs. The observed data loss was browsing telemetry; theft of stored credentials or browser sessions was a capability risk, not a confirmed outcome for this extension.
5. Other social-engineering routes: Sophos observed AI-themed sites directing victims to run finger.exe from the Windows Run dialog; a fake Microsoft Copilot document share leading to the EvilProxy adversary-in-the-middle kit; OpenAI-branded credential harvesting; and a ChatGPT Atlas user induced to run an unspecified curl command that installed an information stealer.
6. AI-development supply chain: A poisoned LiteLLM PyPI package executed on one endpoint. In another case, a claude-mem npm plugin installed through NPX fetched and ran code from a remote GitHub repository. Execution was confirmed, but Sophos could not determine whether a human or an AI agent initiated either installation. No affected package versions or package hashes are supplied.
7. Financial-services bespoke-application intrusion: An attacker exploited SQL injection in a bespoke PHP application hosted on a device not enrolled in MDR. The attacker deployed web shells, ran discovery commands, attempted credential access and executed Chisel for TCP tunnelling before pivoting to MDR-protected endpoints. A custom Rust Windows RAT then polled a Slack channel for host-tagged commands. Repository artefacts described command execution, URL-based file downloads, retrieval of DPAPI-encrypted configuration, scheduled-task deployment and a reverse shell that was later removed during development. Internal strings were renamed from rat-agent to svc. The repository history showed a human account directing a Claude coding-agent account; this supports AI-assisted development, not autonomous operation. No Slack channel, token, scheduled-task name, port or configuration path was disclosed.
8. Separate SonicWall SMA ransomware case: Sophos reports initial access through a chain involving CVE-2026-15409 and CVE-2026-15410. The operator connected from macOS and used Base64-encoded PowerShell; one script contained verbose, templated comments and another internal-discovery script contained Mandarin comments. Before ransomware deployment, the attacker tested write access with:

cmd.exe /C mkdir C:\test_enc & echo Hello World > C:\test_enc\test1.txt & echo Second file > C:\test_enc\test2.txt & echo {"data":"test"} > C:\test_enc\data.json & echo SQL dump > C:\test_enc\db.sql & echo backup data > C:\test_enc\backup.bak & echo This is a test document > C:\test_enc\readme.doc & echo email content > C:\test_enc\email.msg & dir C:\test_enc > C:\Windows\Temp\pMGiNNjc.tmp 2>&1

The eventual ransomware encrypted its own extortion note. The ransomware family, encryption extension and demand were not reported. AI authorship remains circumstantial: detailed comments, command structure and a weak hostname/repository overlap do not prove that an LLM generated the tooling. No authoritative CVSS scores, severity classifications, affected versions, fixes or CISA KEV states were resolved for either CVE.

No privilege-escalation technique was reported. Lateral movement was described only as a pivot from the unmanaged PHP host to protected endpoints. Confirmed data-access effects were browser telemetry exfiltration, credential-phishing exposure and information-stealer deployment; the source does not confirm exfiltration of financial or customer data.

Confidence caveat: Case-level detail and the IOC dataset originate from Sophos. Help Net Security restates Sophos’s findings and is not independent technical corroboration. Except where Sophos itself references matching public reporting, the material is single-sourced; verify before enforcement. No named actor is reliably attributed, and no supporting MITRE actor profile was supplied.

4. Mitigation & containment

P1 — within 24 hours

• Load the §5 hashes and defanged network indicators into SIEM, DNS, proxy, NDR and EDR hunting. Validate local observations before blocking because the set is single-sourced and includes compromised sites and infrastructure that may have changed. Isolate endpoints showing both IOC contact and suspicious execution.
• Hunt for mshta retrieving from AI-themed infrastructure, irm <url> | iex, browser-launched PowerShell, finger.exe, AI-lure-driven curl, browser process-hollowing attempts and execution of untrusted .msixbundle files. Block browser-to-script-interpreter execution where business policy permits.
• Inventory managed Chromium extensions. Remove extensions contacting perplexity-ai[.]online or the Tilda landing page, overriding search behaviour, or failing publisher verification. Preserve the extension directory and browser telemetry before removal. Revoke browser sessions and reset exposed credentials where information-stealer execution or unauthorised session access is confirmed.
• Quarantine files matching the supplied SHA-256 values. Treat the names claude.exe, claude.msixbundle and libcef.dll as hunt pivots only: names alone are insufficient because legitimate applications may use them.
• For exposed SonicWall SMA deployments, determine immediately whether the installed build is affected by CVE-2026-15409 or CVE-2026-15410 and apply current vendor guidance. Restrict external access where operationally feasible pending assessment. This advisory provides no verified fixed version or CISA KEV state.
• If a bespoke PHP application or otherwise unmanaged device is exposed, place it under EDR/MDR coverage or isolate it. Review application and WAF logs for SQL injection, web-shell creation, Chisel execution and connections to the listed Chisel infrastructure.

P2 — within 72 hours

• Search retained process, PowerShell, AMSI, DNS, proxy and browser-extension logs for all §5 indicators and §6 behaviours. Prioritise endpoints that ran mshta, PowerShell, finger.exe or curl shortly after visiting search advertisements or newly registered AI-themed domains.
• Hunt for C:\test_enc, C:\Windows\Temp\pMGiNNjc.tmp, the dummy files in the command above, Base64-encoded PowerShell and internal network-discovery activity.
• Review Slack audit and endpoint telemetry for unauthorised binaries repeatedly polling Slack from servers or unmanaged Windows devices. Investigate the supplied Slack-RAT hashes and unexpected Rust binaries; do not block Slack globally without validating business use.
• Identify LiteLLM and claude-mem use in package manifests, lockfiles, CI/CD logs and developer-agent histories. Suspend unidentified or unpinned instances until package origin and integrity are established. Constrain NPX and agent-driven dependency execution to approved registries and repositories.
• Remediate SQL injection in bespoke PHP applications through code correction, application-layer testing and WAF controls. Remove web shells, rotate credentials accessible to the compromised application and investigate Chisel-enabled access before returning the host to service.

P3 — within 7 days

• Restrict AI software acquisition to an internal catalogue or confirmed vendor domains. Block known typosquats and require signature, publisher and hash validation for installers.
• Enforce an allowlist for browser extensions and alert on new search-provider overrides, broad browser permissions and extensions contacting non-vendor infrastructure.
• Apply dependency pinning, approved registries, provenance review and remote-fetch controls to AI-agent and LLM packages.
• Close EDR/MDR coverage gaps for developer workstations, legacy systems and bespoke web applications. Include these assets in application testing and exposure-management scope.
• Update awareness material: users must not paste commands from software-installation pages, CAPTCHA prompts, advertisements or shared AI conversations into Run, PowerShell or a terminal.

No affected package versions, vendor-fixed builds, registry remediation keys or SonicWall patch versions are present in the supplied material.

5. Indicators of compromise

The following indicators come from the SophosLabs dataset linked by the primary report. They are single-sourced; verify before enforcement. Infrastructure may be time-bound, and as-kapital[.]com and util-locate[.]com were described as compromised sites rather than necessarily attacker-owned infrastructure.

domain  download-version[.]1-5-8[.]com
domain  download-version[.]1-8-3[.]com
domain  download-version[.]1-9-18[.]com
domain  download-version[.]2-1-9[.]com
domain  download[.]active-version[.]com
domain  events[.]ms709[.]com
domain  claude-setup[.]com
domain  code[.]verification-claude-cdn[.]beer
domain  finger[.]claudemo[.]net
domain  claudefos[.]com
domain  deepaichats[.]com
domain  chatsaigpt[.]com
domain  chataigpt[.]pro
domain  chatgptsidebar[.]pro
domain  chatgptbuddy[.]com
domain  copilot[.]info
domain  copilot[.]domains
domain  openew[.]app
domain  claudverification-id[.]beer
domain  greenactiv[.]com
domain  as-kapital[.]com
domain  util-locate[.]com
domain  perplexity-ai[.]online
url  hxxps://extension[.]tilda[.]ws/perplexityai
ipv4  144[.]172[.]102[.]171
ipv4  134[.]122[.]1[.]247
ipv4  5[.]181[.]3[.]142
ipv4  91[.]195[.]240[.]123
sha256  98d1f151872c27d0abae3887f7d6cb6e4ce29e99ad827cb077e1232bc4a69c00
sha256  20ba72e91d7685926c8c1c5b4646616fa9d769e32c1bc4e9f15dddaf3429cea7
domain  claude-pro[.]com
domain  license[.]claude-pro[.]com
domain  get-mactech[.]com
domain  mymachub[.]com
domain  update-crowdstrike[.]com
domain  update-sentinelone[.]com
sha256  1cbcf213219a9c01de64354c836f77bfb70af5459e48bb947bd0b8011f67be35
sha256  bed31c30a7c08e38f9c540bc87eb1bbcbddb5dc48f3bdcf011e2e6e8bb2f6051
sha256  becb8d7d7b2c0dbce9e7d022bfe9948c030508f285e6d4b5c822bf034961a2fb
sha256  ef9935cb14c0e3259d9d2a8b43b48c67e9bdf5cae12d9a26048a70e13cb3c698
sha256  62cdaecc867678720251b732cec0f2e845666f51d39d7cde064984bff3831c33
ipv4  185[.]193[.]66[.]120
ipv4  64[.]227[.]138[.]82
ipv4  129[.]212[.]225[.]220
filepath  C:\test_enc
filepath  C:\Windows\Temp\pMGiNNjc.tmp

Behavioural indicators

6. Detection

For Sophos-managed estates, the source lists these countermeasures:

• Delivery and execution: Mal/HTMLGen-A, WIN-EVA-PRC-MSHTA-HTTP, WIN-EXE-PSH-SUSP-IEX-1, WIN-PROT-BEHAVIORAL-MALWARE-EXEC-19C-T1218-005, WIN-PROT-AMSI-AMSI-PROTECTION-AMSI-PSDLR-G, WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1.
• Payload, C2 and access: Troj/Beagldr-A, ATK/DonutLdr-B, OSX/InfoStl-FQ, WIN-PROT-BEHAVIORAL-MALWARE-C2-10A-T1071-001, Troj/RAT-NG, Troj/WebShel-BU, Troj/WebShel-KB, PHP/WebShell-CD, ATK/Chisel-F, WIN-PROT-VDL-MALWARE-ATK-CHISEL-F, WIN-CRD-PRC-PSQL-SUSP-VEEAMBACKUP-1.

The following YARA rule targets the distinctive pre-encryption write-test command. It detects scripts or tooling containing the artefacts; it does not establish a ransomware-family attribution.

rule AT_2026_08_PreEncryption_Write_Test_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-25"
        reference = "https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands"
        description = "Detects file-path strings from the observed pre-encryption write-access test"

    strings:
        $file1 = "C:\\test_enc\\test1.txt" ascii wide
        $file2 = "C:\\test_enc\\test2.txt" ascii wide
        $file3 = "C:\\test_enc\\data.json" ascii wide
        $file4 = "C:\\test_enc\\db.sql" ascii wide
        $file5 = "C:\\test_enc\\backup.bak" ascii wide
        $file6 = "C:\\test_enc\\readme.doc" ascii wide
        $file7 = "C:\\test_enc\\email.msg" ascii wide
        $tmp = "C:\\Windows\\Temp\\pMGiNNjc.tmp" ascii wide

    condition:
        $tmp and 3 of ($file*)
}

title: AI-Branded InstallFix and ClickFix Command Execution
status: experimental
description: Detects command-line combinations reported in fake AI installer and social-engineering cases.
author: Adverse Trace
date: 2026-08-25
references:

  - https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands
logsource:
  category: process_creation
  product: windows
detection:
  selection_mshta:
    CommandLine|contains|all:

      - 'mshta'
      - 'download-version.1-9-18.com'
  selection_irm_iex:
    CommandLine|contains|all:

      - 'irm '
      - '| iex'
  selection_finger:
    CommandLine|contains|all:

      - 'finger.exe'
      - 'finger.claudemo.net'
  condition: selection_mshta or selection_irm_iex or selection_finger
falsepositives:

  - Legitimate administrative use of irm and iex; validate parent process, user context and destination.
level: medium

title: Observed Pre-Encryption Write-Access Test
status: experimental
description: Detects the exact directory and temporary-file artefacts used before ransomware deployment.
author: Adverse Trace
date: 2026-08-25
references:

  - https://www.sophos.com/en-gb/blog/fake-ai-real-malware-attackers-impersonating-ai-brands
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:

      - 'cmd.exe /C mkdir C:\test_enc'
      - 'C:\test_enc\db.sql'
      - 'C:\test_enc\backup.bak'
      - 'C:\Windows\Temp\pMGiNNjc.tmp'
  condition: selection
falsepositives:

  - Security testing that intentionally reproduces the published command.
level: high

The source provides no exact Slack channel, scheduled-task name, service, registry key, browser-extension identifier or malicious package version. Rules based on those fields cannot be authored without fabrication.

7. Sources

• Sophos X-Ops, Fake AI, real malware: Attackers impersonating AI brands, 19 August 2026.
• Help Net Security, Attackers impersonate popular AI brands to spread malware, 21 August 2026.
• SophosLabs, AI_2025-2026_IOCs.csv, accessed 25 August 2026.

8. Adverse Trace position

Adverse Trace assigns no formal CVE-based severity because no authoritative CVSS scores, severity classifications or CISA KEV states were resolved for this item. The client impact can nevertheless be material where users install unverified AI tooling, browser extensions intercept regulated browsing activity, developer agents execute uncontrolled dependencies, or bespoke applications remain outside monitoring coverage. Confirmed compromise warrants P1 containment, but the reporting does not support treating all AI software or AI-agent use as malicious, nor does it establish autonomous attack execution. No named-actor attribution is confirmed. Most technical detail and the IOC set are single-sourced; verify before enforcement. Adverse Trace will monitor for independent corroboration, affected package versions, extension identifiers, SonicWall remediation data, IOC changes and defensible actor attribution.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.