Two vendors independently published in the same week on the same delivery chain — an employee searches for an AI coding assistant, clicks a sponsored result, and pastes a one-liner into a terminal — and in one case the page hosting the instructions was on the vendor's own genuine domain

Two managed-detection providers published on the same delivery chain two days apart this week, from separate telemetry, without citing each other. That convergence is the reason this belongs in a strategic view rather than in either day's operational coverage: it moves "employees searching for AI tools get malware" from an anecdote to a measured, cross-vendor initial-access vector.

Sophos X-Ops supplies the measurement. Reviewing twelve months of managed-detection casework from 2 July 2025 to 29 June 2026, it tagged 86 cases for AI involvement, confirmed 34 on individual review against its own taxonomy, added four found through analyst investigation, and worked from the resulting 38. Of those, AI software impersonation accounted for 30, and the Claude brand was the most frequently abused lure at 26 of the cases reviewed (Sophos X-Ops, 2026-08-19). Its framing of the finding is the headline result: "Attackers are exploiting the surge in demand for AI software by faking the software itself: names users trust, like Claude, ChatGPT, and Copilot, become delivery vehicles for malware." The typical chain is a user searching for an AI coding tool, landing on a typosquatted site through a malicious ad, and being walked through an "InstallFix" pretext — a variant of ClickFix in which the cover story is software installation — into running an obfuscated one-liner. In one case a fake Claude site instructed the victim to run an mshta one-liner, followed by a PowerShell download-and-execute one-liner running code in memory. The most developed example Sophos observed outside its own casework was a fake Claude site that delivered a DLL-sideloading chain ending in a backdoor Sophos names Beagle — which is the same name it gave a fake-Claude DLL-sideloading backdoor documented in May 2026 and already carried in this store. A parallel vector runs through browser extensions impersonating AI assistants — one marketed as an AI sidebar bundling several assistant brands — which functioned as infostealers.

Two findings from Sophos are worth separating from the alarm. First, its verdict on detection: in the impersonation cases it reviewed, the decisive protections were conventional delivery- and payload-behaviour detections rather than anything AI-specific. Second, and more useful for scoping: of the 38 cases, 35 fall under malicious targeting of AI — abuse of AI products, brands and ecosystems — rather than under attackers wielding AI as a capability. For a defender deciding where to spend attention on "AI threats", a year of casework says the brand is the exposure, not the model.

Huntress's case removes the step everyone's guidance depends on. Its MacSync analysis describes a victim searching "How to Install Claude on a Mac", clicking a sponsored Google Ads result, and being taken to Anthropic's genuine claude.ai domain — to a publicly shared conversation page rather than the official install guide, carrying a badge showing it had been shared under the display name "Apple Support", with the page instructing the reader to paste a curl one-liner into Terminal (Huntress, 2026-08-17). Every control that keys on the destination passes: the domain is real, the certificate is the vendor's, there is no typosquat to catch, and standard user guidance — "check you are on the vendor's real site" — returns the wrong answer.

The chain behind it is six stages and worth knowing in outline because each one is a different telemetry class. The initial curl returns a 1,442-byte zsh loader, a three-line wrapper around a gzip-compressed, Base64-encoded payload; because the wrapper is polymorphic, each build differs by the victim token the attacker issues. One Huntress analyst's conclusion is the operational summary: "you can't detect based on the hash, you're gonna have to detect on the behavior." Stage two runs a background zsh function in memory; stage three is a server-side AppleScript stealer that keeps the valuable logic off the endpoint behind an API-key gate; stage four installs a Mach-O remote-access tool that builds a property list and triggers a launch agent named after an updater already present on the host, giving persistence across logins; a separately signed helper exists to obtain a single screen-recording permission; and a set of wallet-application trojans completes it. The collection covers browser cookies and logins, keychain secrets, account passwords, Telegram sessions, SSH keys and cloud keys, alongside three trojanised hardware-wallet companion applications phishing for recovery phrases — of which Huntress notes the property that makes that last category different in kind: "A recovery phrase doesn't work like that; there is nothing to revoke or reset, nothing to stop the access."