Of 1,258 public sandbox analyses that ANY.RUN tied to fake AI tool campaigns between April 15 and Oct. 5, 2026, 81% imitated Claude, ChatGPT or Codex. The count comes from a malware-analysis firm’s own submission pool, not from a census of every attack, but the lopsided split shows which brand names criminals now consider the best bait. Claude alone accounted for 601 of the analyses, or 48%.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The figure reached a wide audience through a sponsored article on BleepingComputer written by Push Security, a browser-security vendor that sells products aimed at this exact problem. That context does not change the arithmetic, which traces to ANY.RUN, but it does explain why the piece leans toward the argument that ClickFix-style lures are the main threat to office browsers.
What ANY.RUN counted, brand by brand
The study was written by a cyber threat analyst who publishes under the name s1nc3rt on ANY.RUN’s blog in an Oct. 14 post. It breaks the 81% into two pieces: 601 analyses (48%) involving counterfeit Claude pages and software, and 418 (33%) involving counterfeit OpenAI products, meaning ChatGPT and Codex. The same report lists GitHub Copilot, Gemini, Ollama, OpenClaw, Perplexity and Manus among the other brands being copied, though it gives no per-brand totals for them. The United States ranked second to India as a source of the submissions.
One caution on wording: the unit being counted is a sandbox analysis that analysts linked to a campaign, so the percentage describes what researchers submitted and examined. “Fake installers” is shorthand for a mix of counterfeit download pages, command-line install pages and shared chat links, not a single kind of file. ANY.RUN found that at least 45% of the analyses, 561 of them, came from campaigns that told victims to paste a command: 341 from fake command-line install pages and 220 from fake download pages using ClickFix. It calls 45% a floor, because another 320 analyses began on shared AI chats and many of those also ended in a pasted command.
InstallFix and LLMshare, the two lures behind the AI theme
Push’s article describes two techniques that explain why AI brands work so well. InstallFix, which Push first documented in March 2026, clones the legitimate install pages of tools such as Claude Code, Codex and NotebookLM, promotes the copy through search ads, and swaps the install command for a malicious one. Because tools like Claude Code really are installed by pasting one line into a terminal, a victim has no reason to hesitate. Classic ClickFix has to invent a pretext for pasting; InstallFix does not.
In one recent cluster Push described, a search for “claude mac” returned a sponsored result that displayed a bing.com address, passed through Bing’s click tracking to a compromised retail site, and landed on a fake “Download Claude” page. The page showed Anthropic’s genuine install command while its copy button placed a different one on the clipboard, which fetched a hidden URL and piped the script straight into the shell without saving a file to disk. Two cloaking layers sent anyone who had not arrived through the ad to a harmless page or a 404.
The second technique, LLMshare, which Push reported in May 2026, abuses the sharing features of ChatGPT and Claude to publish chats and artifacts containing malicious instructions or fake download links, then advertises them in search. The newest variant uses custom GPTs; one answered every prompt with a fake service notice pointing to a Google Sites page that served a Windows ClickFix payload, and Push said it had more than 10,000 conversations when observed.
Why search results, not email, are the delivery route
Push says 4 in 5 of the ClickFix pages it intercepted in 2026 were reached from search engines, through compromised websites, malvertising and search-result poisoning, which means email filters never see them. The company’s detection-data write-up reports ClickFix averaged 52% of its detections through the second quarter and reached 67% in August, and that AI-themed InstallFix and LLMshare attacks made up about 5% of all attacks in its last quarterly snapshot. Those are the vendor’s detections from its own customers, so they describe its sensor footprint.
Independent scale comes from Microsoft. Its 2026 Digital Defense Report, as summarized in the Push article, says ClickFix attacks grew roughly 23-fold between December 2025 and May 2026, that attacker-supplied commands ran on more than 1.1 million unique devices between February and early May, and that 96.3% of ClickFix intrusions ended in malware. Microsoft called the method “one of the most conversion-efficient initial access techniques.”
The practical pattern in the sources is consistent: the dangerous moment is the paste, not the download. The BleepingComputer piece notes that Macs, contractor laptops and developer workstations often have little endpoint protection, and that people looking for an AI app tend to search for it instead of typing the vendor’s address. Anyone installing an AI tool is better served by starting from the vendor’s own site than from an ad, and by treating any page that asks for a pasted command as a reason to stop.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
