Hackers Impersonate Claude, ChatGPT and Copilot to Deliver Infostealers and Backdoors

Threat actors are increasingly abusing the popularity of generative AI brands to distribute malware, turning trusted names such as Claude, ChatGPT and Microsoft Copilot into convincing lures for infostealers, browser hijackers and remote-access backdoors.

Sophos X-Ops reviewed 12 months of Managed Detection and Response (MDR) investigations, spanning July 2, 2025 to June 29, 2026.

They found that the dominant AI-related threat was not autonomous AI-driven intrusion. Instead, attackers were impersonating legitimate AI software, websites, and extensions to trick users into executing malicious payloads.

Of 86 MDR cases initially tagged for AI involvement, 34 were confirmed as genuine adversarial AI activity. Four additional cases uncovered during investigations raised the final dataset to 38.

The findings challenge the assumption that AI-enabled attacks are primarily about sophisticated agentic malware.

In 35 of the 38 cases, attackers were targeting AI brands, products or ecosystems rather than using AI as an operational capability. AI software impersonation alone accounted for 30 cases, with Claude branding appearing in 26.

The most common attack chain begins when a victim searches for an AI coding assistant or chatbot client and lands on a typosquatted domain, malicious advertisement or poisoned search result.

The site then presents a convincing installation workflow designed to persuade the user to copy and run a command.

Sophos classifies this as “InstallFix,” an installation-themed variation of ClickFix social engineering.

Rather than displaying a fake CAPTCHA or browser error, the attacker presents polished download instructions that lead victims to execute obfuscated PowerShell, mshta, or other living-off-the-land commands.

In one campaign, a fake Claude site instructed victims to run an mshta one-liner that retrieved a payload from download-version[.]1-9-18[.]com.

The chain delivered a Windows app package impersonating Claude, then used irm <url> | iex to run code in memory and attempt browser process hollowing. Related infrastructure also distributed LummaStealer through fake CAPTCHA-style ClickFix pages.

Other variants used a Claude Setup.zip archive containing a malicious libcef.dll, or a repackaged claude.exe that actually functioned as a loader.

Sophos also documented a fake Claude campaign that used DLL sideloading to deploy a previously undocumented backdoor called Beagle.

AI brands malware

Sophos observed browser extensions marketed as AI assistants including one advertised as an “AI Sidebar with DeepSeek, ChatGPT, Claude” that behaved as infostealers and communicated with attacker-controlled command-and-control infrastructure.

These extensions are particularly dangerous because users often grant them broad permissions over browser sessions, web activity and stored credentials.

In one incident, four Sophos customers installed a fake Perplexity extension that hijacked browser searches and exfiltrated browsing telemetry in real time.

The extension appeared in the Chrome Web Store, redirected searches through perplexity-ai[.]online, and carried a superficially credible 4.7-star rating, 67 reviews and 10,000 installs.

A financial services organization was compromised through SQL injection against a bespoke PHP application running on a device not enrolled in MDR.

The case demonstrates why marketplace presence, install volume and user ratings cannot independently establish extension legitimacy.

Attackers are also using AI brands strictly as a social-engineering wrapper.

Sophos identified campaigns abusing Claude-themed pages to convince users to execute PowerShell commands, fake Microsoft Copilot document-sharing lures that redirected victims to EvilProxy adversary-in-the-middle phishing kits, and OpenAI-branded pages designed to steal credentials.

Other campaigns used ChatGPT share links as malware lures, exploiting the trust users place in legitimate AI collaboration features.

In these cases, the real product name is not the payload; it is the mechanism that lowers a victim’s suspicion long enough to trigger execution or credential submission.

The defensive lesson is straightforward: AI-branded malware still depends on familiar delivery and execution techniques.

Organizations should enforce verified software acquisition, block typosquatted domains, audit AI-themed extensions by publisher reputation and permissions, and retain strong behavioral detection for PowerShell abuse, mshta, DLL sideloading, in-memory execution and suspicious browser credential access.

AI dependencies also require the same supply-chain governance applied to conventional software packages. Sophos identified cases involving a poisoned LiteLLM PyPI package and a malicious claude-mem npm plugin that fetched code from a remote GitHub repository.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide