Cybercriminals are employing sophisticated tactics to exploit commonly used platforms such as Google Ads, GitLab, and the Claude AI chat feature, manipulating user trust to execute malicious commands. By masquerading as well-known AI development tools, these attackers utilize ClickFix social engineering techniques, convincing victims to manually run harmful commands, which often involves copying and pasting commands into PowerShell or terminal interfaces, as highlighted by TrendAI researchers.
The campaign specifically targeted users seeking popular AI development resources, funneling over 2,000 individuals from sponsored search results to sites designed to deliver malware. This multifaceted approach highlights how attackers are effectively leveraging the inherent trust users have in established platforms, making their social engineering efforts appear more legitimate and harder to identify.
Dissecting the Attack Waves
A notable feature of this campaign was its reliance on reputable services rather than suspicious domains or fake websites. Over the course of seven weeks, the attackers used 92 distinct malicious hostnames across GitLab pages, imitating legitimate brands like ChatGPT Codex, Perplexity, and JetBrains while simultaneously promoting Mac utility scams.
The initial wave, occurring between April 8-13, centered around the primary lure found at claude-code-app.gitlab.io. It also featured Mac utility-themed scams such as mac-clean-storage.gitlab.io. A singular Google Ads campaign ID (23736589328) was pivotal in driving significant traffic during this period.
Subsequent waves from April 14-21 diversified the campaign, introducing Claude-themed variants and expanding the array of Mac utility lures. The impersonation tactics intensified in the third wave, with the appearance of perplexity-platform.gitlab.io and chatgpt-codex.gitlab.io.
As the campaign progressed to its fourth wave (April 29 - May 5), it notably pivoted towards branding associated with ChatGPT and Codex, with the introduction of domains like codexgpt.gitlab.io. By the fifth wave (May 6-14), attackers shifted focus from self-hosted GitLab pages to leveraging Claude AI’s legitimate shared chat feature, utilizing it to generate persistent links that led victims to poisoned pages. The final wave observed a complete transition to utilizing the claude.ai chat feature.
Experts suggest the campaign primarily targeted developers and technically adept users. The belief that interactions with AI-driven tools like Claude are authoritative falls into the cognitive bias trap, where users are more likely to accept harmful instructions issued by seemingly reputable sources.
Flaws in Reputation-Based Security
The strategy's effectiveness stems from its ability to blend malicious activity with normal user behavior, relying on trusted platforms throughout the attack sequence. Amit Jaju, a senior managing director at Ankura Consulting, emphasized that this type of assault doesn’t prompt victims to question suspicious entities; instead, it enhances trust through familiar brands, legitimate ad networks, and well-regarded AI platforms. This clever manipulation minimizes resistance against click-throughs and execution of harmful commands.
Jaju explained this approach exemplifies "trust stacking," where every component appears credible, enhancing the perceived safety of the overall process. By exploiting platforms that companies typically permit and trust, attackers can obscure their malicious activities within routine operations, complicating detection efforts.
Dhar noted that most organizations do not restrict access to services like Google or GitLab in order to maintain operational functionality. Consequently, traditional reputation-based security protocols struggle, underscoring the need for deeper behavioral analysis in cybersecurity measures.
Disrupting the Attack Chain
If a developer inadvertently concedes to these types of attacks, the repercussions can far exceed those of a standard user breach. A compromised developer machine houses sensitive information like session cookies, SSO tokens, SSH keys, and access credentials, opening avenues to code repositories and enterprise systems.
Based on this, organizations can implement several defensive strategies. Recognizing that attackers increasingly rely on manipulating user actions rather than rogue software installations is vital. Limiting administrative privileges, scrutinizing PowerShell and shell executions, and monitoring for unusual behavior are effective starting points. Especially for developers, it’s crucial to supervise access due to the extensive privileges they wield.
From an administrative perspective, businesses should enforce least privilege access on developer workstations and segment their environments to distinguish between high-risk browsing and critical engineering tasks. This layered approach could significantly mitigate the impact of such sophisticated attack vectors.
