Hackers Exploit ChatGPT, Claude, DeepSeek Brands in Credential Phishing Attacks

Threat actors are increasingly weaponizing the global fascination with large language models and generative AI by impersonating major AI brands ChatGPT, Anthropic’s Claude, DeepSeek, and others to trick users into revealing credentials, payment information, and to install malware.

These campaigns are not breaches of the vendor platforms; they are classic social engineering and distribution techniques dressed with AI tools themed lures to increase click-through and trust.

Attackers combine urgency-based messaging (billing updates, policy violations, account appeals) with carefully staged infrastructure: compromised or legitimately registered redirectors, abused CDN-hosted release assets, CAPTCHA-like gating to frustrate automated analysis, and final landing pages that harvest credentials or deliver infostealers.

A recurring pattern is the use of trusted services CRM redirectors, URL shorteners, AWS tracking domains, and GitHub release assets as stepping stones to evade filters and inflate perceived legitimacy.

One high-volume example impersonated ChatGPT to request payment updates for “ChatGPT Plus,” redirecting victims through multiple legitimate redirectors to a compromised domain hosting a multi-page phishing kit that collected names, addresses, and full credit card data.

That campaign delivered tens of thousands of emails globally in bursts, with targeted spikes observed in South Africa, Switzerland, and Austria.

Microsoft Threat Intelligence observed multiple, distinct campaigns in 2026 that reused legitimate branding, SEO techniques, malvertising, and multi-stage redirect chains to bypass defenses and scale theft and infection at pace.

Another campaign impersonating Claude used enforcement-themed PDF attachments “Fill and Sign Claude Appeal Form.pdf” to steer recipients toward phishing pages gated by Cloudflare verification and ultimately to an AiTM-style flow designed to intercept authentication tokens.

AI Brands Exploited

Malvertising and fake installers amplified reach. Storm-3075–attributed malvertising delivered malicious “AI plugin” downloads to users on free streaming sites; the installers were code-signed with fraudulently obtained certificates and, after a user-driven checkbox interaction, dropped Python-based downloaders that fetched Vidar and other stealers.

Microsoft and partners revoked the signing certificates and took down repositories, yet the speed and scale some campaigns reaching tens of thousands of devices within hours highlight the operational efficiency of these threat infrastructures.

GitHub release-asset abuse was particularly effective against users searching for new models. Within hours of DeepSeek announcing V4, a malicious GitHub organization published a convincing “DeepSeek-V4” repository that included stolen logos, real benchmark tables, SEO-optimized metadata, and 7z release archives.

Search engines and LLM-powered search elevated that fake repository into prominent results, causing real downloads of loader executables that installed Vidar. The attackers rotated archive hashes and preserved naming to keep the lure active while evading simple signature-based blocklists.

These campaigns underscore several technical realities: threat actors blend new thematic lures with established tradecraft; multi-stage redirection and CAPTCHA-like gating impede automated detection and sandboxing.

Abuse of reputable platforms (GitHub, CRM services, CDNs) undercuts reputation-based protections; and code-signing-as-a-service economies like Fox Tempest materially increase malware success by lowering suspicion at the OS level.

Defenders should prioritize identity protection and time-of-click controls. Enforce phishing-resistant multifactor authentication across accounts and remove MFA exemptions.

The campaign, users were redirected to a page advertising a download for an “Awesome AI Windows plugin”, a fictitious product name. 

Deploy time-of-click URL analysis and automatic attack disruption capabilities to break multi-step chains. Use endpoint and network protections SmartScreen-like URL blocking, network protection to block malicious domains, and threat-hunting telemetry to identify unusual redirector patterns and rapid repository creation.

Monitor public code-hosting for sudden, SEO-optimized repositories using stolen branding and archive release assets; integrate takedown workflows with platform providers and law-enforcement partners.

For technical context and guidance, see Microsoft’s analysis “AI as tradecraft: How threat actors operationalize AI” and related write-ups on Fox Tempest and the DeepSeek/GitHub abuse incidents.

Public vendor advisories and partner research from Trend Micro, Zscaler, and Huntress document the same rotating ecosystem where lures mimic trending AI tools while delivering Vidar, GhostSocks, Lumma, and other stealers.

Vigilance, rapid disruption, and identity-centric defenses remain the most effective counters as threat actors continue to exploit AI brand trust as a scalable social-engineering vector.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.