Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers impersonate AI products to spread malware and steal credentials.
Run Claude?
Get an email when a reviewed story names Claude, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Threat actors are impersonating popular AI products like ChatGPT and Gemini to distribute malware, steal browser sessions, and compromise business accounts. These campaigns, observed extensively through ANY.RUN sandbox analyses, leverage social engineering tactics such as fake download sites and sponsored search results to trick users into executing malicious commands. The attacks put significant operational pressure on Managed Security Service Providers (MSSPs) due to the repetitive nature of investigations across multiple clients.
The lesson from this incident
Full lessonThreat actors are exploiting the widespread popularity of AI tools like ChatGPT and Gemini by impersonating them through fake download sites and sponsored search ads, tricking users into executing malicious commands. The root cause is insufficient user awareness about verifying software sources, combined with the inherent trust users place in familiar brand names. Once executed, the malware can steal browser sessions and compromise business accounts, creating cascading risks across entire organizations. For MSSPs managing multiple clients, the repetitive investigation burden highlights the need for scalable, early-detection workflows to contain these threats before they spread.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
- malware — mshta.exe