Fake AI Tools Target US Firms via Counterfeit Claude and ChatGPT

ANY.RUN linked 1,258 public sandbox analyses to fake AI tool campaigns between April 15 and October 5, 2026. Attackers impersonate Claude, ChatGPT, GitHub Copilot and Gemini to deliver infostealers and hijack browser sessions. Claude and ChatGPT accounted for 81% of analyses, with the US ranking second by submissions after India.

• 1,258 sandbox analyses tied to fake AI campaigns from April 15 to October 5, 2026
• Claude accounted for 601 analyses (48%), ChatGPT and Codex for 418 (33%)
• At least 45% of campaigns ask victims to paste commands into PowerShell or Terminal
• US submitters made up 69 of 422 country records (16%), second after India