Cybercriminals have increasingly turned to impersonating well‑known artificial‑intelligence services, leveraging the trust that users place in brands such as Perplexity, Claude, ChatGPT and Copilot. By masquerading as legitimate AI tools, attackers distribute a range of malicious payloads, including information stealers, backdoors, deceptive browser extensions, and other forms of malware that can compromise both personal devices and corporate networks.
Sophos’ X‑Ops team conducted a year‑long review of managed detection and response incidents that featured AI‑related activity, spanning from mid‑2025 to mid‑2026. The investigation initially flagged a large batch of cases for potential AI involvement, and after detailed analysis a substantial portion was verified as malicious. The researchers also incorporated a handful of incidents uncovered in separate probes, expanding the final data set to include dozens of confirmed AI‑related attacks.
The analysis revealed that a majority of the incidents focused on targeting AI products, their branding, or the broader ecosystem surrounding them. Software impersonation emerged as the dominant technique, with attackers repeatedly recreating the look and feel of authentic AI applications. Among the impersonated brands, the Claude service appeared most frequently, surfacing in a significant number of the reviewed cases.
A recurring method identified by Sophos is the “InstallFix” approach, which builds on the older “ClickFix” pattern. While ClickFix typically tricks users with fake error messages or verification steps, InstallFix presents a polished, step‑by‑step guide that appears to facilitate a legitimate installation. The process culminates in the user copying and executing commands—often heavily obfuscated—that ultimately deliver a malicious payload onto the system.
One illustrative example involved a counterfeit Claude website that guided victims through an mshta command designed to fetch a payload from a domain crafted to look like the official site. The downloaded file was disguised as a Windows application bearing the Claude name, either as a standard executable bundle or an MSIX package. Once launched, the code executed directly in memory and attempted to hollow out browser processes, a technique that enables the malware to run stealthily within trusted applications. Variants of this scheme included a malicious setup archive and a repackaged executable that acted as a loader for additional malicious components.
From a defensive standpoint, the decisive indicators in these impersonation attacks were rooted in conventional delivery mechanisms and payload behaviors rather than any unique characteristics of artificial‑intelligence technology. The most reliable safeguard remains unchanged: users should obtain AI tools exclusively from verified vendor domains, avoiding third‑party sources that could be compromised.
Related: New Cybersecurity Tools Arrive August 2026
Beyond standalone installers, attackers have also deployed fake browser extensions that pose as AI assistants. One such extension marketed itself as an “AI Sidebar with DeepSeek, ChatGPT, Claude,” yet functioned as an infostealer, relaying harvested data to a command‑and‑control infrastructure. These extensions often request permissions that enable them to monitor browsing activity and capture sensitive information.
A separate incident involved a fraudulent Perplexity extension distributed through the official Chrome Web Store. The extension hijacked search queries, rerouted them through a look‑alike domain, and streamed browsing data to attacker servers in real time. Its presence on the store was bolstered by a high rating and a substantial number of user reviews, giving it an appearance of legitimacy that could easily deceive unsuspecting users.
In a case affecting a financial services organization, Sophos identified what it describes as a clear instance of AI‑generated attack tooling. The intrusion began with a SQL injection that compromised a custom PHP application. Subsequent investigation uncovered a remote‑access Trojan that communicated via Slack, linked to a public GitHub repository where a human contributor collaborated with a Claude‑based coding agent.
The Trojan, written in the Rust programming language, periodically polled a Slack channel for commands. Its intended capabilities spanned command execution, file retrieval, configuration data download, and the establishment of persistence through a scheduled task. At one development stage, the code also incorporated functionality to open a reverse shell, indicating a progression toward more aggressive post‑exploitation behavior.
During a different ransomware investigation, analysts observed tooling that featured unusually thorough comments and highly structured PowerShell scripts. While these characteristics suggest the possible involvement of AI‑generated code, Sophos emphasized that the evidence remains circumstantial and does not definitively prove the use of artificial‑intelligence assistance in that particular case.
Sophos’ telemetry did not reveal any autonomous AI‑driven attacks operating without human oversight. When AI was employed, it served as a lightweight augmenting tool, falling into the “AI‑generated” sub‑category where a human operator retains primary control over the malicious campaign.
