- Any.Run's researchers matched 1,258 public sandbox submissions to fake AI tool campaigns over about six months of 2026. These are analyses, not confirmed infections.
- At least 45% involved a victim pasting a command. Mail gateways and file scanners have less to inspect in those chains.
- An approved AI tool list, installed through IT, is now a security control. Restricting built-in Windows tools such as mshta.exe adds a second layer.
Picture a developer who searches for the install page of an AI coding tool. One result looks like the vendor's documentation. It offers a one-line command. The developer copies it and presses Enter. No firewall was breached. The employee carried out the decisive step.
That is the common thread in new research from Any.Run, a malware-analysis firm. In every chain its analysts examined, a staff member's own action was what moved the attack forward. The lesson for leaders is that when AI tools arrive faster than IT approves them, the search box becomes the entry point. In the pasted-command chains, email and file defenses have less to inspect.
What the researchers counted
Over about six months, from April 15 to October 5, 2026, Any.Run's analysts matched 1,258 public sandbox submissions to campaigns built on fake AI brands. A sandbox is a safe test machine where analysts run suspicious files. Activity peaked in May at 358 analyses and has stayed between 108 and 151 a month since July.
These numbers count analyses, not victims. Dark Reading reported that an Any.Run spokesperson could not say how many infections resulted. Any.Run also sells sandbox and threat-intelligence products, so read the data as one vendor's view.
How the lures work
Any.Run describes a shared outline: bait in a search result or email, a cloned page on a host people trust, then one action by the employee. Only that action changes. Five patterns carried most of the activity.
The first is the fake install page, called InstallFix, with 341 analyses. Pages copy the install guides of tools such as Claude Code, GitHub Copilot CLI and Ollama. They swap the vendor's domain in the one-line command for the attacker's. The developer then runs the attacker's script with their own permissions. The fake Ollama variant installs the real tool, so it works while an infostealer runs beside it.
The second is the fake download page, with 220 analyses. A click copies a command and tells the visitor to press Win+R and paste. The chain uses mshta.exe, a built-in Windows program. No file reaches the downloads folder, so a file scanner has less to flag. In 37 of these analyses, the session began with a click on a Google ad.
The third hides on the AI platform itself. Any.Run found a published claude.ai artifact reached from a Google ad. Another session started at a Google ad and landed on a shared conversation on chatgpt.com. It held one note about heavy load and a link to a "backup domain." ChatGPT warned that the link pointed to an outside site. Even so, the domain's name made the detour seem like part of the service. Any.Run counted 320 analyses in chains like these. The lure sits on the vendor's own domain, which no company blocks.
Stolen sessions skip the password
The fourth pattern asks for no pasted command. The employee only clicks "Setup" in a window. A fake Claude site serves a copy of the real download page. The installer that then runs is the genuine one, from Anthropic's servers. Behind it, a scheduled task starts Microsoft Edge without a window and sends the browser's cookies to the attacker.
A cookie is the browser's proof that you already signed in. Any.Run says that with those cookies the attacker can open the victim's web sessions without a password or MFA prompt. The sandbox showed the cookies being sent out. Multi-factor authentication protects the login. It does not protect a session that has already been stolen.
The fifth pattern targets marketers and also needs no pasted command. Pages invite visitors to "Run ads on Claude" or connect a Google Ads account. A fake sign-in window, drawn inside the page, imitates Google's. Any.Run saw this pattern in 57 analyses, spread over four brands, from July 21 to September 18.
Who carries the risk
A developer's shell may sit close to valuable material: the company's source code, SSH keys, build-pipeline tokens, and cloud and AI service keys. Marketing teams hold ad budgets and billing access. The attack reaches whatever the person it lands on can reach.
That figure counts the countries of people who submitted analyses. It does not count victims or targets. Any.Run also reports the US ranked first in the fake "Download Claude" campaign (21 of 92 records) and the ChatGPT-themed chains (18 of 86).
What to ask your team
Each pattern begins when someone hunts for an AI tool on their own, the researchers say. They cite IBM's 2026 Cost of a Data Breach study, which found shadow AI incidents rose from 20% to 43% of security incidents. Shadow AI means tools staff use without approval.
Four questions follow from the research.
First: do staff have a short approved list of AI tools, each with its official download source, pushed out through device management or the software portal? Second: who owns AI tool requests, and do they have a licence budget so approval is faster than a "free download"?
Third: can standard users run mshta.exe, wscript.exe or unsigned PowerShell? As controls, the report points to AppLocker, WDAC and attack surface reduction rules, which are Windows tools that limit what programs may run. Fourth: do staff know to check install commands against the vendor's official documentation, not a search result, ad or shared chat?
For the security team, Any.Run says domains change often but command shapes, staging paths and backend APIs stay more consistent. Detection built on behaviour will last longer than a blocklist.
An AI tool nobody approved is a tool anybody can counterfeit.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Any.Run.
