Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early

Attackers are running widespread campaigns impersonating popular AI tools like ChatGPT, Midjourney, and Google Bard to push malware, steal browser session tokens, and compromise business accounts. ANY.RUN’s telemetry linked 1,258 public sandbox analyses to these fake AI campaigns between April and October 2026, with US businesses making up 16% of country-attributed targets. The operational pressure on MSSPs is significant, as these attacks often bypass traditional email filters and land directly on endpoints via search engine ads and social engineering.

Technical Breakdown – TTPs: Attackers use malvertising and fake landing pages for AI tools to deliver stealers (e.g., RedLine, Vidar) and remote access trojans. Initial access often relies on users searching for “ChatGPT desktop app” or “AI image generator.” – IOCs: No specific hashes or IPs provided in the report, but the primary indicator is lookalike domains (e.g., chat-gpt[.]download, midjourney-ai[.]pro) and signed executables masquerading as AI installers. – Targets: Primarily US-based SMBs and enterprises served by MSSPs; attackers aim for browser session hijacking to bypass MFA on SaaS platforms.

Defense MSSPs should enforce strict application allowlisting for AI tools, deploy browser isolation for ad-clicked downloads, and monitor for anomalous session token usage (e.g., logins from new geos without re-authentication). Blocking known fake AI domains via DNS filtering is a quick win.

Source: https://thehackernews.com/2026/10/fake-ai-attacks-spread-across-us.html