> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Impersonation campaigns targeting Claude and ChatGPT users surge using ClickFix tactics - URL: https://f4n6.co.uk/security-feed/impersonation-campaigns-targeting-claude-and-chatgpt-users-surge-using-clickfix-tactics/ - Published: 2026-10-16T21:31:43.000Z - Updated: 2026-10-16T21:31:43.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Threat actors are impersonating the brands of popular AI platforms, including Anthropic's Claude, OpenAI's ChatGPT, Google Gemini, Microsoft Copilot, Perplexity, Meta Muse and Manus, to deliver credential phishing and malware. The lures span phishing email, malvertising and search engine optimization (SEO) poisoning, and several campaigns use ClickFix-style tactics that talk the victim into running PowerShell commands on their own workstation. Microsoft Threat Intelligence attributes some of the malvertising activity to the initial access broker Storm-3075, which has delivered payloads signed by the malware-signing-as-a-service offering linked to the actor Fox Tempest, on behalf of downstream actors. No CVE is associated with this item and no CISA KEV entry applies. The risk to EMEA financial services sits in the endpoint and identity path: a developer or business user who follows a fake AI portal or pastes a ClickFix command hands the actor code execution and, in the phishing variants, working credentials and MFA codes. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | ClickFix lures lead to user-executed PowerShell and, in the phishing variants, credential and MFA capture inside the firm's own estate | The ICT-related incident management process must cover user-initiated execution and credential compromise, not only server-side intrusion | | DORA Art. 18 | AI-brand phishing that harvests payment card and personal data, and malware delivery, are incident types the firm must classify | Classification must account for social-engineering-led incidents and their downstream fraud and data exposure | | NIS2 Art. 21(2)(d) | The campaigns abuse legitimate third-party services (a CRM platform, an Amazon tracking domain, OpenAI and Google domains) as redirect and hosting infrastructure | Supply chain security measures must address abuse of trusted SaaS and cloud domains, not only supplier compromise | ## 3\. Technical analysis & attack chain The campaigns do not compromise the AI services they name. Microsoft states the activity is abuse of AI brand names as lures, and no referenced vendor is described as breached. The common thread is a multi-stage redirection chain that requires user interaction and leans on the reputation of trusted domains to survive email filtering. Confirmed steps, drawn from the Microsoft account of the ChatGPT-themed phishing campaign detected on 5 May 2026: 1. The victim receives an email with the sender display name "ChatGPT" and the subject "To ensure your ChatGPT Plus continues to work – please update your payment method". A ChatGPT logo sits at the top of the body. 2. The message warns that the account will be downgraded to a free plan if a new payment method is not supplied within seven days. 3. The victim clicks an "Update payment method" button. The button does not link directly to the attacker site. 4. The click passes through a chain of legitimate and abused redirectors: first grupoconstat\[.\]bitrix24\[.\]com\[.\]br, a legitimate CRM service, then awstrack\[.\]me, an Amazon domain used for email open and click tracking, then onward to the attacker-controlled page. 5. The landing page collects credit card data and personal information such as name and address. Microsoft recorded 4,500 emails in the 5 May 2026 wave, 97% of them to targets in South Africa, as part of a broader campaign using similar themes and infrastructure. The same campaign was observed sending as many as 100,000 emails in a single day to targets in Switzerland, Austria and South Africa, across higher education, professional services and other sectors. The ClickFix variant works differently. SecurityWeek reports that personalised ChatGPT Custom GPTs were used to impersonate legitimate products and trick users into executing PowerShell commands. Dark Reading describes the same pattern as a ClickFix-style campaign in which actors abuse legitimate domains from OpenAI and Google to fool users, turning ChatGPT into a remote access trojan delivery lure. The user is induced to run the command themselves, so the code executes under their own account and the initial access control that blocks a dropped executable does not apply. Sophos X-Ops reviewed 12 months of managed detection and response cases covering 2 July 2025 through 29 June 2026\. Of 86 cases initially tagged for AI involvement, 34 were confirmed as malicious activity involving AI. The confirmed cases involved impersonation of Perplexity, Claude, ChatGPT and Copilot to spread information stealers, backdoors and malicious browser extensions. The four additional cases Sophos uncovered are not detailed in the summary available here. A separate cluster impersonates advertising products for AI chatbots, including Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse and Manus. The Hacker News describes a human-operated phishing platform offering fake campaign optimization, spend audits and business-account connections. The portals capture credentials and MFA codes. The full mechanics of that platform are not in the source material available here. Attribution and confidence. Microsoft attributes AI-themed malvertising to the initial access broker Storm-3075, delivering payloads including malware signed by an MSaaS offering attributed to Fox Tempest, on behalf of multiple downstream actors. This is single-sourced to Microsoft and no MITRE ATT&CK profile for Storm-3075 or Fox Tempest is available in the material provided, so treat both names as unconfirmed pending independent corroboration. Anthropic has separately reported that criminal and state-sponsored actors used its Claude models for cyber attacks, weapons design, propaganda and mass surveillance between December 2025 and August 2026, branding the actors Generative Threat Groups; that reporting concerns misuse of the model as a tool, not impersonation of the brand, and the two should not be conflated. ## 4\. Mitigation & containment P1, within 24 hours: - Block the redirector chain at the web proxy and DNS layer: grupoconstat\[.\]bitrix24\[.\]com\[.\]br and awstrack\[.\]me. Where the business has a legitimate need for Bitrix24 or Amazon tracking domains, scope the block to the specific hostnames rather than the parent domain. - Hunt email logs for the sender display name "ChatGPT" and the subject line "To ensure your ChatGPT Plus continues to work – please update your payment method", and for the 5 May 2026 and 100,000-message waves. Quarantine and purge matching messages. - Hunt endpoint telemetry for PowerShell spawned by a browser process, and for users pasting multi-line commands into a Run dialog or terminal after visiting an AI-branded page. ClickFix execution is user-initiated, so the parent process is the browser or the shell, not an office application. - Force credential resets and revoke active sessions for any user who submitted credentials or MFA codes to a fake AI portal, and review those accounts for new MFA device registrations. P2, within 72 hours: - Block or restrict unapproved ChatGPT Custom GPTs and third-party GPT store links at the browser and proxy layer. The Custom GPT is the lure surface, not a compromised OpenAI asset. - Add detection for browser extensions installed outside the managed allowlist, given the malicious browser extensions Sophos confirmed in its MDR case review. - Review payment and procurement workflows for the subscription-renewal pretext. Any payment-detail change triggered by an email link should require out-of-band verification. P3, within 7 days: - Run an awareness push that names the AI-brand lure explicitly and states the rule: no employee pastes a command from a web page into a terminal, and no payment method is updated from an email link. - Verify that endpoint detection covers script-block logging and command-line capture, since the ClickFix payload is a command line, not a file on disk. No vendor fix or patch applies to this item. There is no CVE and no software version to pin. ## 5\. Indicators of compromise | type | value | confidence | source | | ------------------- | --------------------------------------------------------------------------------- | ---------- | ----------------------------- | | domain | grupoconstat\[.\]bitrix24\[.\]com\[.\]br | high | Microsoft Threat Intelligence | | domain | awstrack\[.\]me | high | Microsoft Threat Intelligence | | email subject | To ensure your ChatGPT Plus continues to work – please update your payment method | high | Microsoft Threat Intelligence | | sender display name | ChatGPT | high | Microsoft Threat Intelligence | ```iocs domain grupoconstat[.]bitrix24[.]com[.]br domain awstrack[.]me email_subject To ensure your ChatGPT Plus continues to work – please update your payment method sender_display_name ChatGPT ``` The atomic indicators above come from a single source, Microsoft Threat Intelligence, and cover only the ChatGPT-themed phishing wave. The ClickFix, malvertising and fake ad-portal clusters described in the other sources carry no atomic indicators in the material available. Verify the domain blocks against current traffic before enforcing them broadly. Behavioural indicators: | behaviour | where to observe | confidence | | ------------------------------------------------------------------- | ------------------------------------------------------- | ---------- | | Browser process spawning PowerShell or a terminal | EDR process tree, script-block logging | high | | User pasting a multi-line command after visiting an AI-branded page | EDR command-line telemetry, browser history correlation | medium | | Credential and MFA code submission to a non-vendor AI portal | Identity provider sign-in logs, proxy logs | medium | | New browser extension installed outside the managed allowlist | Browser management console, EDR | medium | | Payment-detail change following an email link | Finance and procurement systems, email gateway | medium | ## 6\. Detection The sources give usable artefacts for the phishing wave: the sender display name, the subject line and the two redirector domains. The ClickFix and malvertising clusters give behaviour but no distinctive strings, so the rules below cover the phishing chain. ```yara rule AI_Brand_Phishing_ChatGPT_Payment_Lure { meta: author = "Adverse Trace" date = "2026-10-16" reference = "https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/" description = "Detects ChatGPT-branded payment-renewal phishing email bodies and redirector links" strings: $subject = "To ensure your ChatGPT Plus continues to work" ascii nocase wide $body1 = "please update your payment method" ascii nocase wide $body2 = "Update payment method" ascii nocase wide $redir1 = "grupoconstat.bitrix24.com.br" ascii nocase wide $redir2 = "awstrack.me" ascii nocase wide condition: uint16(0) == 0x0A0D or filesize < 2MB and 2 of them } ``` ```yaml title: ChatGPT-branded payment phishing email and redirector chain id: 8f2c1a44-3d7e-4b21-9c05-6a1e2f7b9d10 status: experimental description: Detects inbound mail using the ChatGPT payment-renewal lure or the abused redirector domains author: Adverse Trace date: 2026/10/16 references: - https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/ logsource: category: email product: mail_gateway detection: selection_subject: subject|contains: 'To ensure your ChatGPT Plus continues to work' selection_sender: sender_display_name: 'ChatGPT' selection_url: url|contains: - 'grupoconstat.bitrix24.com.br' - 'awstrack.me' condition: selection_subject or selection_sender or selection_url falsepositives: - Legitimate OpenAI billing notifications from the real vendor domain level: high ``` ```yaml title: Browser process spawning PowerShell after AI-branded page visit id: 2b6d9e10-7c34-4a58-b1f2-0d9e4c3a5f21 status: experimental description: Detects ClickFix-style user-initiated PowerShell execution from a browser parent process author: Adverse Trace date: 2026/10/16 references: - https://www.securityweek.com/hackers-use-chatgpt-custom-gpts-in-clickfix-attacks/ - https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - '\chrome.exe' - '\msedge.exe' - '\firefox.exe' selection_child: Image|endswith: - '\powershell.exe' - '\pwsh.exe' - '\cmd.exe' condition: selection_parent and selection_child falsepositives: - Managed browser extensions and IT automation that legitimately launch a shell level: medium ``` ## 7\. Sources - Dark Reading, Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk, https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk, 2026-10-16 - SecurityWeek, Hackers Use ChatGPT Custom GPTs in ClickFix Attacks, https://www.securityweek.com/hackers-use-chatgpt-custom-gpts-in-clickfix-attacks/ - Microsoft Threat Intelligence, AI brands as bait: How threat actors are using the AI hype in social engineering, https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/, 2026-06-08 - The Hacker News, Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes, https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html, 2026-10 - Help Net Security, Attackers impersonate popular AI brands to spread malware, https://www.helpnetsecurity.com/2026/08/21/ai-brand-impersonation-malware-malware-research/, 2026-08-21 - Dark Reading, Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure, https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure - The Hacker News, Claude Used to Automate Exploitation and Data Theft Across Multiple Victims, https://thehackernews.com/2026/09/claude-used-to-automate-exploitation.html, 2026-09 ## 8\. Adverse Trace position No CVE is associated with this item and no CISA KEV entry applies, so the severity here is operational rather than patch-driven: the campaigns are low-complexity social engineering that succeeds because the lure is a brand employees already trust and the ClickFix step puts execution in the user's hands. The impact on an EMEA financial services client is concentrated in identity and endpoint compromise, with a secondary fraud path through the payment-renewal pretext, and the Sophos MDR figures (34 confirmed malicious AI-related cases in 12 months) show the technique is producing real infections rather than only blocked email. Attribution to Storm-3075 and Fox Tempest is single-sourced to Microsoft and unconfirmed, and the atomic indicators cover only the ChatGPT phishing wave, so we are not treating the domain blocks as a complete control. We will track the ClickFix and fake ad-portal clusters for atomic indicators, and we will reissue this advisory if a vendor publishes hashes or command strings that let us extend the detection set beyond the phishing chain. --- [Read the original source →](https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*