Analysis · DiggingBeagle record
A real AI product can arrive inside a malicious installer
Counterfeit AI onboarding campaigns exploit separate trust confusions: authentic platform hosts, copied command-line docs, fake browser sign-ins, clipboard commands and wrappers that also launch legitimate installers.
- Published
- Oct 15, 2026
Overview
An AI installer can complete successfully while the process that launched it does something else. In one analyzed counterfeit Claude setup chain, the loader ran a genuine installer and also scheduled a task that used headless Edge with remote debugging to submit browser cookie and extension data to an operator endpoint. The visible software installation was not evidence that the wrapper was trustworthy.
Five paths to the same unsafe handoff
ANY.RUN's investigation distinguishes several delivery patterns that are easy to conflate when all are described simply as "fake AI tools":
| Entry point | What the visitor is asked to trust | Documented consequence or mechanism |
|---|---|---|
| Shared AI chats and artifacts | A genuine hosting domain for user-authored material | Links and instructions can redirect to attacker-selected installation or verification steps |
| Copied CLI installation guides | A familiar documentation layout and a one-line setup command | A shell command instead fetches a loader from non-vendor infrastructure |
| Fake Claude download instructions | A clipboard command presented as a setup step | Tested chains proceed from mshta to staged PowerShell execution |
| Advertising and beta sign-in lures | A browser-in-browser window that looks like Google login | An attacker-controlled page presents counterfeit identity-provider UI |
| Wrapped Claude setup | The fact that a genuine application is installed | A parallel scheduled-task path collects browser data in the described sandbox trace |
The source reports 320, 341, 220 and 57 public analyses for four of these clusters, respectively. Those are sandbox analyses, not independent infected devices, distinct human victims or confirmed account takeovers. They cannot be totaled into a victim figure, and overlapping samples may exist.
What the branding actually proves
A legitimate AI-platform domain does not make a shared conversation or artifact a vendor-approved instruction. A familiar developer command does not become safe because the guide imitates the original documentation. An installer successfully writing the expected application to disk does not authenticate every other action taken by its parent process.
These incidents primarily concern software distribution, local execution and authentication phishing. They are not evidence that Claude, Gemini or other named models were induced to execute malware by their own inference processes. Their AI-security relevance lies in the trust users place in AI-product surfaces and the operational onboarding path around those products.
A useful review therefore separates the source of an installation instruction from the authority to execute it, and inspects the process chain independently of the product name displayed to the user. The canonical Cases retain the individual delivery details and their evidence limitations.