AI Tools Security Review Shows Malware Campaigns Targeting Claude and ChatGPT Users

Analyses covering April through early October 2026 documented a clear increase in malware campaigns that impersonate popular AI coding tools. Researchers recorded 1,258 public sandbox submissions linked to these lures, with activity remaining above 100 submissions per month after a May peak of 358. Claude and ChatGPT accounted for roughly 81 percent of the analyzed cases.

Developers and knowledge workers remain the primary targets. US organizations appeared in about 16 percent of tagged submissions and led several Claude-specific and ChatGPT-specific campaigns. Attackers exploit routine search and install habits by placing malicious results in search engines and sponsored ads.

AI Tools Security Review: Documented Attack Patterns

Five recurring delivery methods appeared across the campaigns. InstallFix and CLI one-liner swaps led in volume, with examples such as fake commands that download scripts from attacker domains before pulling additional payloads from GitHub repositories. ClickFix-style pages that instruct users to run mshta or PowerShell commands followed closely behind.

Trojanized installers, shared chat artifacts on platforms like LLMshare, and browser-in-the-browser phishing pages rounded out the set. These vectors often mimic legitimate GitHub, GitLab, or Cloudflare Pages hosting to reduce suspicion. Payloads included infostealers such as Aura Stealer and remote access tools like AsyncRAT and Quasar RAT.

A separate family, Aoki infostealer variants first observed earlier in 2026, specifically searches for local AI configuration files including .claude.json, Codex config.toml, and cookies from multiple AI clients. The same family also harvests browser data and cryptocurrency wallets.

• InstallFix/CLI one-liner swaps: 27–341 analyses
• ClickFix fake download pages: 17–220 analyses
• Trojanized installers and shared artifacts: 25 percent of cases
• Browser-in-the-browser account phishing

Payload Risks and Recommended Verification Steps

Stolen session cookies allow account takeover without triggering new multi-factor prompts. Attackers can then access source code repositories, cloud API keys, advertising accounts, and paid AI quotas for further abuse. These outcomes affect both individual developers and the organizations that employ them.

Practical verification reduces exposure. Users should download installers only from official vendor domains and approved package managers. Restricting PowerShell and mshta execution through group policy or endpoint controls limits many of the observed one-liner and ClickFix techniques. Monitoring for unexpected scheduled tasks or headless browser activity provides early behavioral indicators.

Enterprises can maintain an allow-list of approved AI tools and require verification of file hashes against published vendor signatures before deployment. Regular review of browser extensions and stored credentials further limits the value of any successful cookie theft.