Cybersecurity
ANY.RUN links fake AI campaigns to US businesses
ANY.RUN said it found 1,258 public sandbox analyses tied to campaigns impersonating AI services between April and October 2026, and argued that MSSPs could use its tools to spot them sooner.
- ANY.RUN said it linked 1,258 public sandbox analyses to fake AI campaigns between April and October 2026, and said US businesses accounted for 16% of country-attributed targets.
- The campaigns impersonated Claude, ChatGPT, GitHub Copilot, Gemini and other services to prompt employees to run commands, install software or enter credentials.
- In one Claude-themed case, a fake download page copied a command to the clipboard, and the resulting chain launched mshta.exe, fetched a malicious HTA file and ran encoded PowerShell.
- ANY.RUN said its sandbox produced 30% fewer Tier 1 to Tier 2 escalations and a 14-second median detection time, while 30% of unique malicious IOCs from customer investigations were already in its feeds.
ANY.RUN said it had linked 1,258 public sandbox analyses to fake AI campaigns from April to October 2026. It said those campaigns used brand names to push employees towards malware, stolen browser sessions and compromised accounts, and that US businesses were 16% of country-attributed targets.
The company said the lures used Claude, ChatGPT, GitHub Copilot, Gemini and other services, appearing in sponsored results, hosting services, shared conversations and counterfeit download sites. In one case, a page made to look like Claude's download site copied a command when the Windows download button was pressed.
ANY.RUN said the command began with PowerShell instructions, then launched mshta.exe, retrieved a malicious HTA file and started an encoded PowerShell chain. It said the user had started the process voluntarily and that the use of legitimate Windows tools made detection harder.
The article then argued that MSSPs could reduce repetitive investigations by using ANY.RUN's Interactive Sandbox, Threat Intelligence Feeds and Threat Intelligence Lookup. It said the sandbox was associated with 30% fewer Tier 1 to Tier 2 escalations, a 14-second median detection time and 30% of unique malicious IOCs already appearing in its feeds.
Named in this story
Companies
- ANY.RUN
- said it linked the sandbox analyses and promoted its detection tools
Products and systems
- Claude
- was impersonated in one of the campaigns
- ChatGPT
- was impersonated in the campaigns
- GitHub Copilot
- was impersonated in the campaigns
- Gemini
- was impersonated in the campaigns
- Windows
- was referenced in the fake download instructions
- PowerShell
- was used in the malicious execution chain
- mshta.exe
- was launched to retrieve the malicious file
- Interactive Sandbox
- was used by ANY.RUN for behavioural analysis
- Threat Intelligence Feeds
- supplied indicators drawn from investigations
- Threat Intelligence Lookup
- was used to relate indicators to campaign activity
How the source tells it
The article read as a vendor-led security briefing, with routine threat description wrapped in repeated claims about ANY.RUN's products and performance gains.
- vendor boosterism repeated product mentions and percentage claims used to present the tools as broadly effective
- urgency language about mounting pressure, slower response and harder detection across customer environments