IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE40 IOCs

Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot

AC
ANY.RUN Cybersecurity Blog
Published October 14, 2026Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREclaudeadsback-product…https://chatgpt.com/s…mbackend-mdye.onrende…CAPABILITYAsyncRATMETA StealerQuasarRATVICTIMunknown
Adversary
Infrastructure(6)
Capability(3)
Victim

Indicators of Compromise

Indicators of Compromise40

TypeIndicatorConfidenceScoreFirst Seen
Domainclaudeadsback-production-67c1.up.railway.app
intel-blogmalwarenetwork
High
58
Oct 14, 26
URLhttps://chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainmbackend-mdye.onrender.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainopenclaw-setup.net
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainclaude-setup.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainsetup-ollama.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
MD56a80bc61c434819190c3eae5932307e8
file-hashintel-blogmalware
Medium
53
Oct 14, 26
Domainclaubecode.co.com
exploitintel-blogmalware
High
58
Oct 14, 26
Domainclaudecode.us.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainsetup-code.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainhelp.xenngypt.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainstat30ffooo.xyz
intel-blogmalwarenetwork
High
58
Oct 14, 26
SHA256e86f7ba0413a3a4b1d7e1a275b3d1ef62345c9d3fd761635ff188119b8122c85
file-hashintel-blogmalware
Medium
53
Oct 14, 26
Domaincladesktop-apps.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainclaude-ai.us
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domaincodex-console.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainnucleflowers.xyz
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainmonday-brief-claude.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainopenclow.co.com
exploitintel-blogmalware
High
58
Oct 14, 26
Domainkafeprog7.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainparipassuventures.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainsys-tools.cfd
cncexfiltrationexploit
High
76
Mar 19, 26
SHA256882b1aa5432509df9b1ac29b6f987a5dd70c8f46009237de956275a58536f470
file-hashintel-blogmalware
Medium
53
Oct 14, 26
Domaingemini-beta-invitations.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainclaudgodic.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainclaude-advertisement.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainrefract3.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domaincopilotcli.co.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainclaudedev.net
intel-blogloadermalware
High
58
Oct 14, 26
Domaingemini-beta-invites.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainbeta-manus.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainmeta-claude.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainopenai-backup.one
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domaincode-desktop.com
indicatorintel-blogmalware
High
62
Sep 14, 26
Domaininstall-copilot.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
URLhttps://last-version.install-2026.com/app
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainuse-code.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domaincode-setup.com
intel-blogmalwarenetwork
High
58
Oct 14, 26
Domainbudgetforge.ai
exploitintel-blogloader
High
58
Oct 14, 26
Domainperplexity-beta-ads.com
intel-blogmalwarenetwork
High
58
Oct 14, 26

IOC Relationship Graph

IOC Relationship Graph40 total IOCs
DomainURLMD5SHA256
Domain35URL2SHA2562MD51Malware3REPORTFake AI Tools Put US CompaAsyncRATMETA StealerQuasarRAT
scroll to zoom · drag to pan · click IOC to open