Fake AI apps drive 92,000 cyberattacks in early 2026

Kaspersky flags malware disguised as ChatGPT, Claude, and Gemini in global campaigns targeting users and devices.

More than 92,000 malware and potentially unwanted application attacks worldwide were detected by cybersecurity firm Kaspersky in the first months of 2026, with cybercriminals increasingly disguising malicious files as popular AI tools such as ChatGPT, Claude, and Gemini to get users to download them.

The company said the attacks are not limited to a single platform or tactic, but a growing pattern where familiar AI brands are used as bait to make infected files look legitimate. Instead of suspicious software names, the files are packaged to resemble everyday productivity tools already widely used in work and school environments.

Kaspersky shared the findings during its annual Kaspersky HORIZONS conference in Rome on May 19. It reported that within these AI-related attack cases, fake ChatGPT applications accounted for about 49%, while counterfeit Claude and Gemini tools each made up around 18%, showing how heavily attackers are relying on well-known AI platforms to build trust and drive downloads.

Separately, researchers also identified more than 15,000 malware samples posing as AI software since the start of the year. These include fake versions of emerging tools and malicious installers linked to the Silver Fox advanced persistent threat group, which distributed fake Claude applications across Windows, macOS, and Linux systems.

In the Philippines, where AI tools have become part of everyday work routines across freelancing, schoolwork, and small businesses, the concern lies in how easily these disguised files can slip into normal download habits. What appears to be a simple AI installer can instead carry banking trojans, spyware, or malware downloaders that pull in additional malicious programs once activated, often without immediate warning.

READ: