Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
40 IOCs
Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot
Malware Families
Excerpt
ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India. The attacks share one trait: the employee performs the decisive step. They paste an “install command,”…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →40 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | claudeadsback-production-67c1.up.railway.app | High | Score 58/100 | First seen |
| URL | https://chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8 | High | Score 58/100 | First seen |
| Domain | mbackend-mdye.onrender.com | High | Score 58/100 | First seen |
| Domain | openclaw-setup.net | High | Score 58/100 | First seen |
| Domain | claude-setup.com | High | Score 58/100 | First seen |
| Domain | setup-ollama.com | High | Score 58/100 | First seen |
| MD5 | 6a80bc61c434819190c3eae5932307e8 | Medium | Score 53/100 | First seen |
| Domain | claubecode.co.com | High | Score 58/100 | First seen |
| Domain | claudecode.us.com | High | Score 58/100 | First seen |
| Domain | setup-code.com | High | Score 58/100 | First seen |
| Domain | help.xenngypt.com | High | Score 58/100 | First seen |
| Domain | stat30ffooo.xyz | High | Score 58/100 | First seen |
| SHA256 | e86f7ba0413a3a4b1d7e1a275b3d1ef62345c9d3fd761635ff188119b8122c85 | Medium | Score 53/100 | First seen |
| Domain | cladesktop-apps.com | High | Score 58/100 | First seen |
| Domain | claude-ai.us | High | Score 58/100 | First seen |
| Domain | codex-console.com | High | Score 58/100 | First seen |
| Domain | nucleflowers.xyz | High | Score 58/100 | First seen |
| Domain | monday-brief-claude.com | High | Score 58/100 | First seen |
| Domain | openclow.co.com | High | Score 58/100 | First seen |
| Domain | kafeprog7.com | High | Score 58/100 | First seen |
| Domain | paripassuventures.com | High | Score 58/100 | First seen |
| Domain | sys-tools.cfd | High | Score 76/100 | First seen |
| SHA256 | 882b1aa5432509df9b1ac29b6f987a5dd70c8f46009237de956275a58536f470 | Medium | Score 53/100 | First seen |
| Domain | gemini-beta-invitations.com | High | Score 58/100 | First seen |
| Domain | claudgodic.com | High | Score 58/100 | First seen |
| Domain | claude-advertisement.com | High | Score 58/100 | First seen |
| Domain | refract3.com | High | Score 58/100 | First seen |
| Domain | copilotcli.co.com | High | Score 58/100 | First seen |
| Domain | claudedev.net | High | Score 58/100 | First seen |
| Domain | gemini-beta-invites.com | High | Score 58/100 | First seen |
| Domain | beta-manus.com | High | Score 58/100 | First seen |
| Domain | meta-claude.com | High | Score 58/100 | First seen |
| Domain | openai-backup.one | High | Score 58/100 | First seen |
| Domain | code-desktop.com | High | Score 62/100 | First seen |
| Domain | install-copilot.com | High | Score 58/100 | First seen |
| URL | https://last-version.install-2026.com/app | High | Score 58/100 | First seen |
| Domain | use-code.com | High | Score 58/100 | First seen |
| Domain | code-setup.com | High | Score 58/100 | First seen |
| Domain | budgetforge.ai | High | Score 58/100 | First seen |
| Domain | perplexity-beta-ads.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…