SOCshare: 2026 July cyber landscape review

Riding the AI wave: malicious tactics aimed at deploying AI tools

The rapidly growing popularity of AI tools such as ChatGPT and Claude is opening up a new attack vector—threat actors are increasingly using “hype abuse” tactics by impersonating these tools or their deployment processes.

More about SOCshare

The article reviews four real-life incidents from 2025–2026

OpenAI “Poisoned Environment” (June 2026): Attackers created a fake but convincing OpenAI workspace and tricked employees into accessing it without any login or authentication.
Fake Gemini and Claude Code installers (May 2026): Using an SEO poisoning technique, a compromised website distributed information-stealing programs via PowerShell commands, disguised as legitimate installations.
Fake Claude Pro website (April 2026): A malicious program (possibly PlugX or an undocumented backdoor) distributed via DLL side-loading, granting remote access to the victim’s device.
Malicious Chrome extensions (December 2025): Disguised as a legitimate AITOPIA extension, they steal ChatGPT and DeepSeek chat content from more than 900,000 downloads.

Full article, prepared by Lauren Flutey, is available here: read

This entry is published as part of the SOCshare project (No. 101145843), which we are running together with Vilnius City Municipality. It is partly funded by the European Union. The views and opinions expressed are those of the authors alone and do not necessarily reflect those of the European Union or the European Cyber Security Centre of Excellence. Neither the European Union nor the European Cyber Security Centre of Excellence can be held responsible for them.