[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7bfhV0iu-TFBSF3ABOCl6Iot725gcTklUHOG6q16OpQ":3,"$fHvH7p7wXVipcsSoBNaVvK1uCyf6Jbhk5ShayjjNCvEg":97},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":94,"created_at":95,"updated_at":96,"published_at":44},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","A year of MR casework (Jul 2025–Jun 2026) shows 34 victims hit via malvertising and infostealers impersonating major AI brands.","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[10,11,12,13,14],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","infostealer","# Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware\n\n*A year of MR casework (Jul 2025–Jun 2026) shows 34 victims hit via malvertising and infostealers impersonating major AI brands.*\n\n**Tags:** `The Gentlemen` `Sophos X-Ops` `AI brand impersonation` `malvertising` `infostealer`\n\n> Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.\n\n---\n\n## 34 Confirmed Cases of AI Brand Impersonation\n\nSophos X-Ops has confirmed 34 instances of AI brand impersonation used to deliver malware, spanning July 2025 through June 2026. In each case, attackers impersonated Claude, ChatGPT, or Copilot to trick users into executing a payload.\n\nThe delivery mechanism is a combination of malvertising and infostealers, which Sophos says is the primary initial access vector for The Gentlemen’s current campaign. The AI brand front lowers the friction threshold compared to traditional ransomware download links, and the infostealer logs feed directly into the credential pool that The Gentlemen uses for valid-account logins.\n\n## How the AI Brand Fakes Work\n\nVictims are lured to a fake AI brand page via malvertising or an infostealer. The page mimics the branding of Claude, ChatGPT, or Copilot, depending on the target. Once the user lands, the malware is delivered and executed to complete the infection chain.\n\n## Who Was Hit and What They Got\n\nAcross the 12-month window, The Gentlemen confirmed 34 victims. The malware stack is a nine-tool set: Amadey, Backdoor.Turn, Edgecution, Fox Tempest, Qilin Encryptor, RTCore64.sys, SocGholish, StealBit, and StealC. The group references nine CVEs in its exploitation chain, spanning CVE-2023-20269 through CVE-2026-50751, which cover the AnyConnect SSL VPN, Bleed (NetScaler), Connect Secure, ESXi, FortiGate, GlobalProtect, RMM, Remote Access VPN, and driver components used for initial access and lateral movement.\n\n## Key points\n\n- 34 confirmed cases across Jul 2025–Jun 2026\n- Attackers fake Claude, ChatGPT, and Copilot UIs\n- Delivery via malvertising and infostealer payloads\n- No CVE referenced; pure brand spoofing + payload chain\n\n## Further reading & sources\n\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026)\n- [The Gentlemen (2019) – Wikipedia](https:\u002F\u002Fde.wikipedia.org\u002Fwiki\u002FThe_Gentlemen_(2019))\n- [Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target - Brandefense](https:\u002F\u002Fbrandefense.io\u002Fblog\u002Ftop-5-ransomware-groups-q2-2026)\n- [Cybereason Nails 2025 MITRE ATT&CK® Enterprise Evaluation](https:\u002F\u002Fwww.cybereason.com\u002Fblog\u002F2025-mitre-attck-enterprise-evaluation)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754",{"cves":18,"actors":34,"malware":45,"technologies":64},[19,28],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2023-20269",true,"\u002Fvulnerabilities\u002FCVE-2023-20269",9.1,0.2545,"Critical",86.75,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":25,"risk_score":33,"cvss_version":27},"CVE-2026-50751","\u002Fvulnerabilities\u002FCVE-2026-50751",9.3,0.8534,89.46,[35,41],{"url":36,"name":37,"slug":37,"type":38,"origin":39,"motivation":40},"\u002Fthreat-groups\u002Fqilin","qilin","ransomware","Russia \u002F Russian-speaking (excludes CIS countries from targeting)","financial",{"url":42,"name":10,"slug":43,"type":38,"origin":44,"motivation":40},"\u002Fthreat-groups\u002Fthegentlemen","thegentlemen",null,[46,48,50,52,54,56,58,60,62],{"name":47},"Qilin Encryptor",{"name":49},"StealBit",{"name":51},"RTCore64.sys",{"name":53},"SocGholish",{"name":55},"Amadey",{"name":57},"StealC",{"name":59},"Edgecution",{"name":61},"Backdoor.Turn",{"name":63},"Fox Tempest",[65,68,71,74,77,80,83,86,89,91],{"vendor":66,"product":67},"Cisco","AnyConnect SSL VPN",{"vendor":69,"product":70},"Fortinet","FortiGate",{"vendor":72,"product":73},"Palo Alto Networks","GlobalProtect",{"vendor":75,"product":76},"Citrix","Bleed (NetScaler)",{"vendor":78,"product":79},"Ivanti","Connect Secure",{"vendor":81,"product":82},"VMware","ESXi",{"vendor":84,"product":85},"Check Point","Remote Access VPN",{"vendor":87,"product":88},"SimpleHelp","RMM",{"vendor":90,"product":88},"AnyDesk",{"vendor":92,"product":93},"Huawei","driver","campaign","2026-09-30T07:09:51.117027+00:00","2026-10-16T12:28:00.971462+00:00",{"articles":98},[99,109,121,132],{"slug":100,"title":101,"summary":102,"tags":103,"hero_image_url":107,"story_type":94,"created_at":108},"lapsus-phishing-campaign-targets-korean-and-global-financial-sector","LAPSUS$ Phishing Campaign Targets Korean and Global Financial Sector","AhnLab ASEC's June 2026 threat analysis reveals a multi-stage LAPSUS$ phishing campaign targeting the Korean and global financial sector, using a chain of HTML, JS, EXE, and VBE attachments to deploy an infostealer payload.",[104,105,106,40,14],"LAPSUS$","phishing","Korean","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flapsus-phishing-campaign-targets-korean-and-global-financial-sector.png?v=2129e9e17b","2026-09-18T17:07:46.926709+00:00",{"slug":110,"title":111,"summary":112,"tags":113,"hero_image_url":118,"story_type":119,"created_at":120},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.",[114,115,116,117,14,38],"Gen Digital","ClickFix","WordlistLoader","SynkLoader","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","threat_actor_activity","2026-09-25T12:05:45.613962+00:00",{"slug":122,"title":123,"summary":124,"tags":125,"hero_image_url":130,"story_type":119,"created_at":131},"trend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a","Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics","Trend Micro has detailed the sophisticated tactics of The Gentlemen ransomware group, which leverages legitimate driver abuse and Group Policy Object manipulation to compromise manufacturing, healthcare, and construction sectors globally.",[10,126,127,128,129],"Ransomware","Trend Micro","Driver Abuse","Cybersecurity Threats","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a.png?v=fb82a8efc1","2026-08-18T18:29:37.334637+00:00",{"slug":133,"title":134,"summary":135,"tags":136,"hero_image_url":140,"story_type":94,"created_at":141},"clearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum","ClearFake Drops Amatera Stealer via WordlistLoader and SynkLoader on Ethereum","ClearFake's new WordlistLoader and SynkLoader loaders deliver Amatera stealer to Windows targets through ClickFix-style social engineering, with C2 traffic routed through EtherHiding on Ethereum smart contracts.",[137,116,117,138,139,115],"ClearFake","Amatera","EtherHiding","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fclearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum.png?v=9ddcd54bf4","2026-09-25T07:08:58.057093+00:00"]