Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.

The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets.

Similar attacks