Claude and ChatGPT fakes are now tricking developers: 1,258 attacks in six months

Any.Run has published new research on fake chatbot and developer-tool attacks after logging 1,258 incidents over the past six months. In the company’s view, that number shows this has become a mainstream threat for enterprises.

ChatGPT Download

The report says attackers most often pose as Anthropic’s Claude, which showed up in 60% of cases, and OpenAI’s ChatGPT or Codex, which accounted for 33%. They use SEO poisoning, malicious ads, fake download pages, and hosting links that look legitimate to get people to paste terminal commands, run fake installers, or enter credentials into bogus sign-in windows. Any.Run says nearly half of the campaigns relied on ClickFix-style tactics, including fake command-line “InstallFix” lures at 27%, classic spoofed-page ClickFix methods at 17%, and chatbot-themed conversations or files at 25%. All of it depended on social engineering rather than software exploits.

For you and your business, that can mean infostealers or remote access trojans exposing source code, cloud credentials, developer tokens, active sessions, ad and billing accounts, plus repositories, deployment systems, and production environments, all from a single compromised machine.

If you download coding assistants or productivity tools, this report’s worth reading. Any.Run links LLM-based crime tools to 55% of reported cybercrime cases in Africa, one in five attacks in Latin America, and a wider ecosystem that includes WormGPT, FraudGPT, and LLMshare. You can read the full findings from Any.Run.

Malwarebytes Anti-Malware Download