A wave of attacks is abusing trust in popular AI products, according to a report from ANY.RUN. Threat actors are impersonating well-known AI tools to trick users into downloading malware, hijacking browser sessions, and ultimately compromising business accounts. The campaigns appear to be widespread across US companies, though the exact number of victims is not disclosed.
ANY.RUN's data shows 1,258 public sandbox analyses linked to fake AI campaigns between April and October 2026. That figure gives security researchers a concrete measure of how active these lures have become. The sandbox analyses suggest attackers are relying on the familiarity of AI brands to lower user defenses.
For managed security service providers (MSSPs), the trend adds another layer of operational strain. Each incident requires triage, investigation, and response, and the volume of AI-themed lures can overwhelm early detection efforts. The report implies that stopping these attacks early depends on recognizing the impersonation patterns before malware executes.
The key takeaway is that AI branding is now a primary attack vector, not just a tech trend. Organizations should treat unsolicited downloads or login prompts tied to AI tools with suspicion, and MSSPs should prioritize visibility into browser session activity to cut off account takeover attempts quickly.