[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fE7xON4VERr-H7mmVLn_6ZIoUwJgCJgkvPH14euAvLzo":3},{"article":4,"iocs":52,"watch_terms":56,"solutions":57,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8e22fac4-4523-4664-9ff7-856a838b2954","Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early","fake-ai-attacks-spread-across-us-companies-how-mssps-can-stop-incidents-early-db1c11","Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks","Threat actors are impersonating popular AI products like ChatGPT and Gemini to distribute malware, steal browser sessions, and compromise business accounts. These campaigns, observed extensively through ANY.RUN sandbox analyses, leverage social engineering tactics such as fake download sites and sponsored search results to trick users into executing malicious commands. The attacks put significant operational pressure on Managed Security Service Providers (MSSPs) due to the repetitive nature of investigations across multiple clients.","Attackers impersonate AI products to spread malware and steal credentials.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Ffake-ai-attacks-spread-across-us.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhvF5TcwT7nwh6xcCiXS3I0m6qmvF6EorwitA-7ETGlXzpc89JG-rPZye0FkJfFwunfKHXMTkGyg_pBRkBdJv_qaGX32cUdiqoTAA-sjGmsSlKJsL5LUFpyZLiho955h3EtKUCWvtnHyIJgzG1INTIwkqKsCmv3-vsxGXQq8QH-ue0Vl358XyE33wUhxWs\u002Fs1600\u002Ffake.jpg","2026-10-15T11:46:59+00:00","2026-10-15T14:00:11.725611+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Claude","product",{"name":21,"type":19},"ChatGPT",{"name":23,"type":19},"GitHub Copilot",{"name":25,"type":19},"Gemini",{"name":27,"type":28},"Artificial Intelligence","technology",{"name":30,"type":19},"ANY.RUN","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[53],{"type":51,"value":54,"context":55},"mshta.exe","Legitimate Windows utility used to launch malicious HTA files.",[18,21,23],{"controls":58,"vendors":142},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":89,"name":90,"problem":91,"products":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":118,"name":119,"problem":120,"products":121},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[122,129,136],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":118,"product_name":126,"url":127,"description":128},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":133,"url":134,"description":135},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":137,"product_name":138,"url":140,"description":141},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":158},"fake-ai-tools-used-to-distribute-malware-and-steal-business-credentials","Fake AI Tools Used to Distribute Malware and Steal Business Credentials","Threat actors are exploiting the widespread popularity of AI tools like ChatGPT and Gemini by impersonating them through fake download sites and sponsored search ads, tricking users into executing malicious commands. The root cause is insufficient user awareness about verifying software sources, combined with the inherent trust users place in familiar brand names. Once executed, the malware can steal browser sessions and compromise business accounts, creating cascading risks across entire organizations. For MSSPs managing multiple clients, the repetitive investigation burden highlights the need for scalable, early-detection workflows to contain these threats before they spread.",[148,149,150,151,152,153,154,155,156,157],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","CIS Control 10: Malware Defenses","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 IR-4: Incident Handling","NIST CSF DE.CM-1: Network Monitoring","MITRE ATT&CK T1566: Phishing \u002F Social Engineering","MITRE ATT&CK T1204: User Execution","GDPR Article 32: Security of Processing (for EU client data at risk)",{}]