Fake AI App Campaigns Hit US Companies: How MSSPs Detect and Contain AI-Themed Malware Delivery

---
title: AI-Branded Installer Executed from User-Writable Path
id: 3f8a1c92-7b4d-4e51-a9c6-2d1e5f7a8b9c
status: experimental
description: Detects execution of installers or executables masquerading as popular AI products launched from Downloads, Temp, or AppData — a consistent pattern in fake AI malware campaigns tracked by ANY.RUN (Apr-Oct 2026).
references:
  - https://thehackernews.com/2026/10/fake-ai-attacks-spread-across-us.html
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1204.002
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - 'C:\Users\Public\'
  selection_name:
    Image|contains:
      - 'chatgpt'
      - 'chat-gpt'
      - 'openai'
      - 'claude'
      - 'gemini'
      - 'copilot'
      - 'midjourney'
      - 'perplexity'
      - 'ai-assistant'
      - 'ai_assistant'
      - 'aisetup'
      - 'ai-setup'
  filter_legitimate:
    # Microsoft Copilot and other sanctioned AI apps install under Program Files, not user-writable paths
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_path and selection_name and not filter_legitimate
falsepositives:
  - Developers running locally built AI tooling from Downloads
  - Portable AI utilities deliberately run from user directories (tune to your approved software list)
level: high
---
title: Non-Browser Process Accessing Browser Credential and Session Stores
id: 8c2e4d71-5f3a-4b96-c1d8-6e9a2f4b7d35
status: experimental
description: Detects non-browser processes reading Chrome/Edge/Brave credential databases, cookie stores, or DPAPI master keys — the core collection behavior of infostealers deployed via fake AI installer campaigns. Strong indicator of session/cookie theft used to bypass MFA.
references:
  - https://thehackernews.com/2026/10/fake-ai-attacks-spread-across-us.html
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
  - attack.collection
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
  selection_file:
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Local State'
      - '\Web Data'
      - '\Network\Cookies'
  selection_dpapi:
    TargetFilename|contains: '\Microsoft\Protect\'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: (selection_target and selection_file) or selection_dpapi
  # NOTE: Apply Image exclusion at your backend/pipeline level — combine with
  # 'and not filter_browsers' if your file_event source populates Image.
falsepositives:
  - Enterprise browser management/backup agents (whitelist by Image hash/path)
  - EDR/DFIR collection tooling during sanctioned IR
level: critical
---
title: Suspicious Child Process from User-Run Installer (Stealer Staging)
id: b71d9e34-2c8f-4a57-9d63-1e4b6a8c5f02
status: experimental
description: Detects script interpreters and LOLBins spawned by MSIExec or installer executables running from user-writable paths — consistent with fake AI installers staging second-stage payloads and performing post-install theft while a decoy UI displays.
references:
  - https://thehackernews.com/2026/10/fake-ai-attacks-spread-across-us.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - 'C:\Users\Public\'
  selection_parent_type:
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\install.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_parent_type and selection_child
falsepositives:
  - Legitimate installers spawning post-install scripts (rare for consumer-style apps; validate against approved software catalog)
level: high

// Hunt 1: AI-branded executables launched from user-writable paths (last 14 days)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "C:\\Users\\Public\\")
| where FileName has_any ("chatgpt","chat-gpt","openai","claude","gemini","copilot","midjourney","perplexity","ai-assistant","aisetup","ai-setup")
    or ProcessCommandLine has_any ("chatgpt","openai","claude","gemini","midjourney","perplexity","ai setup","ai installer")
| where FolderPath !startswith "C:\\Program Files"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Executions=count()
    by DeviceName, AccountName, FileName, FolderPath, SHA256
| order by LastSeen desc;

// Hunt 2: Non-browser process accessing browser credential/cookie stores
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\", "\\BraveSoftware\\")
| where FileName in~ ("Login Data","Cookies","Local State","Web Data")
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","brave.exe","msedgewebview2.exe")
// Exclude your sanctioned EDR/backup agents here per tenant
| summarize AccessCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256
| order by AccessCount desc;

// Hunt 3: Network egress from freshly-dropped unsigned binaries in user paths
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\")
| where RemoteUrl !has_any ("microsoft.com","windowsupdate.com","google.com") // tune per tenant baseline
| join kind=inner (
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has_any ("\\Downloads\\", "\\AppData\\Roaming\\")
    | project DeviceName, FileName, SHA256, FileCreated=TimeGenerated
) on DeviceName, SHA256
| summarize Connections=count(), DistinctDestinations=dcount(RemoteUrl), FirstFile=min(FileCreated)
    by DeviceName, InitiatingProcessFileName, SHA256
| where DistinctDestinations > 2
| order by Connections desc;

-- Hunt: Infostealer indicators — unsigned binaries in user paths + browser store access
-- Deploy as a client artifact across the fleet; triage hits by signer and hash reputation

LET unsigned_user_bins = SELECT
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    Authenticode AS Signature,
    CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)Downloads|AppData\\(Local|Roaming)|Users\\Public'
   AND Exe =~ '(?i)chatgpt|openai|claude|gemini|copilot|midjourney|perplexity|ai[-_ ]?(setup|assistant|install)')

LET browser_store_handles = SELECT
    Pid,
    Name,
    Exe,
    Username
FROM pslist()
WHERE Name !~ '(?i)chrome|msedge|brave|firefox'
   AND CommandLine =~ '(?i)Login Data|Local State|Cookies|User Data'

SELECT * FROM unsigned_user_bins
UNION ALL
SELECT * FROM browser_store_handles

-- Artifact collection: preserve browser credential/session stores from a suspect host
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
    'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Login Data',
    'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Cookies',
    'C:/Users/*/AppData/Local/Google/Chrome/User Data/Local State',
    'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Login Data',
    'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Cookies'
])
ORDER BY Mtime DESC

#Requires -RunAsAdministrator
# Fake-AI infostealer triage + hardening — Security Arsenal IR kit

$aiPattern = 'chatgpt|chat-gpt|openai|claude|gemini|copilot|midjourney|perplexity|ai[-_ ]?(setup|assistant|install)'
$userPaths = @("$env:SystemDrive\Users\*\Downloads", "$env:SystemDrive\Users\*\AppData\Roaming", "$env:SystemDrive\Users\Public")

# 1) Enumerate and kill running AI-branded processes NOT under Program Files
Get-Process | Where-Object {
    $_.Path -and ($_.Path -notlike "$env:ProgramFiles*") -and
    ($_.Path -notlike "${env:ProgramFiles(x86)}*") -and
    ($_.Name -match $aiPattern)
} | ForEach-Object {
    Write-Warning "Suspicious process: $($_.Name) [$($_.Id)] at $($_.Path)"
    Stop-Process -Id $_.Id -Force
}

# 2) Inventory AI-branded binaries in user-writable paths for IR triage
$triage = foreach ($p in $userPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.exe,*.msi -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -match $aiPattern } |
        Select-Object FullName, Length, CreationTime,
            @{N='SHA256';E={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}},
            @{N='Signer';E={(Get-AuthenticodeSignature $_.FullName).SignerCertificate.Subject}}
}
$triage | Export-Csv -Path "C:\IR-Triage-FakeAI-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation
$triage | Format-Table -AutoSize

# 3) Hardening: enforce SmartScreen (blocks known-malicious downloads) and browser cookie encryption policy
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'EnableSmartScreen' -Value 1 -Force -ErrorAction SilentlyContinue
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name 'SmartScreenEnabled' -Value 1 -Force
New-Item -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' -Name 'SafeBrowsingProtectionLevel' -Value 2 -Force

# 4) Audit: list outbound connections from processes in user paths (stealer exfil check)
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.Path -and $proc.Path -match 'Downloads|AppData\\Roaming|Users\\Public') {
            [PSCustomObject]@{ Process=$proc.Name; Path=$proc.Path; Remote=$_.RemoteAddress; Port=$_.RemotePort }
        }
    } | Sort-Object -Unique Process, Remote

Write-Host "`n[+] Triage complete. CRITICAL NEXT STEPS (manual):" -ForegroundColor Yellow
Write-Host "  - Revoke ALL active sessions in M365/Entra ID and Google Workspace for affected users"
Write-Host "  - Force password reset + re-enroll MFA (session theft defeats existing tokens)"
Write-Host "  - Clear browser cookies/sessions on the endpoint AFTER forensic collection"
Write-Host "  - Submit hashes from triage CSV to your sandbox (e.g., ANY.RUN) for family attribution"