AI brands as bait: How threat actors are using the AI hype in social engineering

Threat actors are increasingly leveraging the global interest in artificial intelligence by impersonating popular AI platforms such as ChatGPT, Copilot, DeepSeek, and Claude in social engineering campaigns. These operations span phishing attacks, malvertising, and search engine optimization-driven tactics that ultimately lead to credential theft, financial fraud, or malware infections. Observed campaigns include ChatGPT-themed phishing collecting credit card data targeting South Africa, Claude-themed adversary-in-the-middle attacks harvesting credentials and access tokens, malvertising campaigns distributing Vidar stealer through fake AI plugin downloads, and fraudulent DeepSeek V4 installers on GitHub. The initial access broker Storm-3075 has been identified employing AI-themed malvertising, while the financially motivated actor Fox Tempest provides malware-signing-as-a-service to enhance payload legitimacy. These campaigns combine traditional social engineering tactics with AI branding to improve success...

• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• September 2026 Infostealer Trend ReportMalware2026-10-28
• SkyW4lker Phishing Kit: Microsoft 365 Threat to US FirmsMalware2026-10-27
• Automated Subversion and Attempted Takeover of AI Pentesting HarnessesMalware2026-10-27