Beware: Malware Attacks Disguised as Popular AI Services Surge

The increasingly massive trend of using artificial intelligence (AI) has become a new loophole for cybercriminals. According to the latest data presented at the Kaspersky HORIZONS conference in Rome, Kaspersky security solutions successfully detected more than 92,000 malware and unwanted application attacks disguised as popular AI services from January to early May 2026.

Criminals exploit public trust in major brands to lure victims into downloading malicious files. Of the total attacks, fake ChatGPT applications were the most dominant bait, followed by other leading AI services such as Claude and Gemini.

Kaspersky researchers have identified more than 15,000 malware samples disguised as AI agent software. The types of threats found are diverse, ranging from banking trojans and spyware to exploits and malware downloaders that can spread additional malicious payloads into the victim’s system.

One of the most significant findings in May 2026 was a campaign by an advanced persistent threat (APT) group named Silver Fox. This group distributed a fake Claude AI application targeting multiple operating systems, including Windows, macOS, and Linux. Once the installer is executed, the malware infiltrates silently to provide the attacker with long-term access to steal sensitive information.

Dmitry Galov, Head of the Russian and CIS unit at Kaspersky GReAT, stressed that the integration of AI agents in corporate environments has changed the risk map for security. "Security is no longer just about protecting endpoints, but about controlling how intelligence, permissions, and decisions propagate across AI-driven processes," he said.

To face this evolving threat, Kaspersky provided several strategic recommendations for organisations. For individual users, a number of steps are also strongly advised.