Malware Disguised as AI Tools Is Now a Top Business Threat

Attackers are distributing malware that looks exactly like ChatGPT, Claude, and DeepSeek. From January through April 2026, Kaspersky detected more than 33,000 attacks on businesses where employees downloaded what they thought was legitimate AI software and got malware instead. That number is nearly five times higher than the same period in 2025.

This is not a sophisticated hacking campaign. It is a distribution problem. Employees search for AI tools, find a convincing fake site or a sponsored Google search result, and download what looks like the software they wanted. By the time anything seems wrong, a remote access trojan has already connected to an attacker-controlled server.

How the Attack Works

The most common lures in early 2026: malware posing as ChatGPT (42% of detections), Claude (24%), and DeepSeek (20%), according to Kaspersky's 2026 SMB Threat Report. Attackers tracked newer tools too. As soon as OpenClaw gained traction this year, fake versions started appearing in the wild. New AI tools create new attack opportunities almost immediately.

Trend Micro documented one campaign called InstallFix. Attackers purchased Google Ads placements for searches like "Claude Code install." The sponsored result led to a fake landing page styled as an official installation guide. Employees who followed the instructions ran a PowerShell command that downloaded malware onto their machine. They thought they were completing a standard setup step.

Malwarebytes reported on a separate fake Claude Pro site distributing PlugX, a remote access trojan that has been in active use since 2008. The installer placed files in a directory spelled "Cluade" (a deliberate typo designed to slide past quick glances) and established a command-and-control connection within 22 seconds of installation. The software appeared to work normally in the foreground. The malware ran in the background.

Sophos found another fake Claude Pro site delivering a DonutLoader payload and a previously undocumented backdoor. By May 2026, the Silver Fox APT group was running fake Claude installers targeting Windows, macOS, and Linux across multiple industries simultaneously.

Why Employees Keep Getting Caught

A few things are working against businesses here.

First, AI tool adoption has moved fast and largely without IT oversight. Employees are figuring out which tools to use on their own. If someone heard that ChatGPT or Claude helps with a specific task, they will search for it. Many are doing this without ever asking IT. That gap between "employees want this tool" and "IT has approved and vetted a download source" is exactly where these attacks land.

Second, the fake sites look convincing. They use real logos, real product names, and in several documented campaigns, the AI software actually ran normally in the foreground while malware executed in the background. No obvious error. No suspicious prompt. No reason to suspect anything went wrong.

Third, sponsored search results feel authoritative. Most people assume a paid Google Ad linking to software has been reviewed somewhere. It has not. Paying for an ad placement requires nothing more than a credit card.

For more on the risks that emerge when employees adopt AI tools without IT governance, the posts on shadow AI risks and AI agent sprawl cover the related exposure in more depth.

What Gets Installed

The dominant threat type in these campaigns is Trojware. Trojans and Trojan-like malware. The Kaspersky report identified more than 1,100 unique malicious samples tied to AI tool lures in the first four months of 2026 alone, a 21% increase from the same period the year before.

What Trojware can do once it is installed varies by payload, but the capabilities documented in 2026 campaigns include stealing credentials, copying and exfiltrating files, modifying or deleting data, downloading and executing additional malware, and establishing persistent remote access for attackers. The Silver Fox campaign specifically targeted businesses for "long-term access to compromised systems and sensitive information."

A compromised endpoint at a 60-person professional services firm or a 120-person healthcare practice is not just a machine problem. It is a potential entry point for credential theft, lateral movement across the network, ransomware staging, and data exfiltration. The breach notifications start going out weeks after the initial download.

What to Actually Do About It

Most of this is preventable with structure that most businesses in the 25-to-200-person range do not have in place yet.

Define an approved AI tools list and publish it. If employees do not know which tools are sanctioned and where to get them, they will search and find whatever ranks highest. That is the attack vector. The list does not need to be complicated: here are the tools your team can use, here is where to get them, everything else needs IT approval before installation.

Limit local admin rights on endpoints. Most growing businesses give employees local admin by default because it is easier at setup. That means any employee can install any software without approval. Managed endpoint protection with application control closes this without requiring IT to approve every individual request manually.

Know the official sources. ChatGPT is at openai.com. Claude has both a web interface at claude.ai and official desktop apps distributed through the official download page. Any third-party site offering a "Pro" version, a downloadable installer from an unfamiliar domain, or a software package from a sponsored search result pointing somewhere other than the official vendor domain is worth treating as suspect.

Run endpoint detection, not just antivirus. The PlugX and DonutLoader campaigns specifically used signed legitimate executables to load malicious DLLs. Standard antivirus often misses this because the parent process looks clean. Endpoint detection and response tools that monitor behavior patterns, not just file signatures, catch these more reliably.

Anna Papla, Kaspersky's UK and Ireland Territory Channel Manager, put it directly in the 2026 SMB report: "Trusted partners, MSPs and security specialists play a vital role, enabling businesses to adopt new technologies safely without adding unnecessary complexity."

The real problem is governance speed. AI tool adoption is running well ahead of security oversight. The businesses getting hit are the ones where employees are making installation decisions without any IT visibility into what is landing on their machines. The businesses not getting hit have a managed layer that catches this before it becomes a breach.

Frequently Asked Questions

How do I know if an AI tool download is legitimate?

Go directly to the official vendor domain rather than clicking search results or ads. ChatGPT and Claude both have official desktop apps and web interfaces, but they are only distributed through openai.com and claude.ai respectively. Any site offering a download that is not the official vendor domain should be treated with suspicion, regardless of where it ranks in search results.

Are sponsored Google Ads for software safe to click?

Not automatically. Attackers purchase Google Ads to promote malicious software downloads. A sponsored result at the top of a search page does not indicate the linked site or download has been reviewed. Several major AI tool malware campaigns in 2026 used paid search placements as the primary distribution channel.

What should a business do if an employee downloaded a suspicious AI tool installer?

Isolate the machine from the network immediately. Do not wait to see if anything happens. The PlugX campaign documented by Malwarebytes established a remote access connection within 22 seconds of installation. Contact your IT team or managed IT provider and treat the device as compromised until it can be fully investigated.

What is Trojware?

Trojware refers to Trojan and Trojan-like malware that disguises itself as a legitimate application. Once installed, it can steal credentials, copy files, download additional malware, or give attackers persistent remote access to the machine. It is the dominant malware type in AI tool lure campaigns.

Does standard antivirus protect against these attacks?

Often not. Attackers in these campaigns use signed legitimate executables, such as real antivirus updater files, to load malicious code through a technique called DLL sideloading. Standard antivirus that checks file signatures frequently misses this because the parent executable appears clean. Endpoint detection and response solutions that monitor behavioral patterns catch these more reliably.