GoKawiilAny.Run finds 1,258 fake Claude and ChatGPT attacks over six months
Any.Run researchers studied malicious campaigns impersonating AI tools and found 1,258 incidents tied to fake Claude and ChatGPT lures over a six-month period on its platform. Attackers used SEO poisoning, malicious ads, fake download pages, and AI-themed artifacts, with Claude impersonated in 60% of cases and ChatGPT/Codex in 33%. Many attacks relied on tricking an employee into running an install command, launching a fake installer, or signing into a spoofed login window.
GoKawiil's interpretation of the reporting above, not reported fact.
The reliance on a single user action to trigger compromise suggests these campaigns are designed to bypass technical defenses by exploiting trust in popular AI brands, according to Any.Run. Because the data comes from security teams at over 16,000 companies using the platform, the real-world scale of infections could be larger than what's captured, the researchers say. The findings point to AI tool impersonation as an emerging vector for credential theft, source code exposure, and financial loss in enterprise environments.
- Any.Run logged 1,258 fake AI-tool attack incidents over six months on its platform.
- Claude was impersonated in 60% of cases, ChatGPT and Codex in 33%.
- Attacks typically require one employee action—running an installer or signing into a fake window—to compromise systems.
YubiKey 5C NFC Security Key — With fake AI tool installers tricking developers into exposing credentials and API keys, hardware-backed authentication is one of the best defenses against account takeover. A YubiKey adds a phishing-resistant second factor so even if a password or session gets stolen, attackers can't log into your cloud, AI, or dev accounts without the physical key.”,
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Rob Wright, 2026-10-16
Published there as: “Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.