Artificial intelligence platforms such as ChatGPT, Claude, and DeepSeek have become favorite targets for impersonation in phishing campaigns. In this latest wave, the impersonated entities are no longer the familiar banks or e-commerce platforms, but the AI brands making the biggest waves today: OpenAI’s ChatGPT, Anthropic’s Claude, and DeepSeek.
It should be made clear that this is not a case of the AI platforms themselves being breached. OpenAI, Anthropic, and DeepSeek have not had their systems taken over by hackers. Attackers simply build interfaces, domains, and logos that look authentic enough to exploit users’ trust, a technique commonly known as brand impersonation phishing.
It is not hard to see why AI brands make such attractive bait. The media buzz surrounding AI means any notification related to ChatGPT, Claude, or DeepSeek easily grabs attention, while the fear of missing out on new technology experiences makes users act more hastily than usual. In fact, the gap between how quickly a technology spreads and how quickly users’ security awareness catches up is always the first place cybercriminals exploit, and AI currently sits right in that gap. This is not an isolated phenomenon either, according to the Phishing Activity Trends report from the Anti-Phishing Working Group (APWG), a nonprofit organization that tracks global phishing trends, the number of brands targeted in phishing campaigns keeps rising steadily each quarter, showing that cybercriminals are increasingly diversifying their impersonation targets rather than focusing on a fixed set of brands.
The first campaign, recorded by Microsoft in May 2026, targeted ChatGPT Plus users. Tens of thousands of emails were sent claiming a payment method issue and asking users to update their card information to avoid service interruption. The targets were concentrated in South Africa, Switzerland, and Austria.
Technically, the email leads users through a multi layer redirect chain that passes through legitimate domains that have been hijacked or abused to evade traditional email filters. Before reaching the actual data harvesting page, users are also asked to pass a fake CAPTCHA step. This small detail is exactly what convinces victims the site is safe enough to enter personal information.
In short, this campaign has three easily identifiable traits:
What stands out in this campaign is that the attacker did not need to breach OpenAI’s systems at all. Building an interface that looks convincing enough was sufficient to fool most victims. This shows that modern phishing succeeds more through psychology than pure technical skill, and this type of domain impersonation technique is also known as email spoofing, a common tactic in large scale fraud campaigns.
Unlike the ChatGPT impersonation campaign, which targeted individual users, the Claude impersonation campaign discovered by Microsoft in April 2026 targeted enterprise accounts directly. The email poses as Anthropic, citing a usage policy violation, and includes a PDF attachment designed to create a sense of urgency that pushes the recipient to act immediately.
The attack chain for this campaign unfolds as follows:
Because this token is what keeps an authenticated session alive, the attacker can bypass multi factor authentication (MFA) entirely without ever knowing the original password. The industries targeted were mainly IT and finance in the United States, the United Kingdom, and India.
According to the Verizon Data Breach Investigations Report (DBIR), a well respected annual report on global data breaches, session token theft techniques are becoming increasingly common precisely because they can bypass the extra authentication layers many organizations still consider strong enough defenses. The fact that AiTM directly targets the IT and finance sectors, which are generally seen as more security aware than average, shows that individual vigilance alone is not enough without an additional technical layer of protection at the infrastructure level. This is also why campaigns of this kind are often classified as spear phishing, given how specifically targeted they are.
The third campaign happened right as DeepSeek announced its V4 release. Within just 45 minutes of the launch announcement, attackers had already set up a fake GitHub repository, complete with the official logo and even real benchmark figures to create an air of absolute credibility.
The attackers did not stop at building a fake page. They also used search engine optimization tactics to push the fake repository to a high ranking on Google, Bing, and even AI powered search tools. Users who trusted the site and downloaded what looked like the official installer were, in fact, installing malware called Vidar Stealer, which is designed to steal login credentials, session cookies, and other sensitive data stored in the browser.
Notably, this is not an isolated campaign but part of a wider rotating ecosystem of AI impersonation, including:
All of these share the same malware distribution infrastructure. The fact that a campaign can be stood up in under an hour shows that manual defenses, which only react after an incident is detected, are almost always a step behind the speed of cybercriminals, making it essential for organizations to shift toward proactive rather than reactive detection.
Although they targeted three different brands with different goals, all three campaigns share several recurring technical traits that can help users spot them early.
| Factor | ChatGPT | Claude | DeepSeek |
| Bait type | Payment email | Policy violation warning email | Fake GitHub repository |
| Main technique | Redirect chain, fake CAPTCHA | AiTM token theft | Information stealing malware |
| Stolen target | Credit card information | Account authentication tokens | Login credentials, cookies |
| Target audience | Individual users | IT and finance enterprises | Developers, technical users |
Looking at the comparison table above, the four most noticeable common signs include:
According to data published by APWG and Verizon DBIR, the average time it takes a user to click a phishing link is significantly shorter than the time it takes them to recognize and report the incident. This shows that the core problem is not that users are unaware of the warning signs, but that the few seconds they take to decide are far too fast compared to the time needed to notice something is wrong, a challenge that is more about designing better warning mechanisms than simply running awareness training.
For businesses, the consequences of AI impersonation campaigns do not stop at a single employee being tricked into entering the wrong information. They can spread into several layers of damage.
According to the FBI IC3’s Internet Crime Report 2025, losses from business email compromise (BEC) fraud surpassed 3 billion USD in 2025, continuing to rise from the previous year. Notably, this was also the first year the report recorded a separate category of AI related complaints, with losses reaching hundreds of millions of USD, showing that fraud campaigns involving AI, including brand impersonation as analyzed above, are becoming a significant financial loss category rather than a theoretical risk.
When an enterprise account is hijacked through the AiTM technique described in the Claude case, employees can immediately lose access to the AI tool they rely on for daily work. For teams that have deeply integrated AI into their workflow, even a few hours of disruption is enough to affect project timelines and overall productivity.
A stolen authentication token does not stop at the compromised AI account. If that account is shared with or linked to other internal systems, the attacker can use it as a stepping stone to move deeper into the enterprise infrastructure, turning what seemed like a minor incident into a much larger intrusion.
If customer data is exposed in the process, the business also faces data breach notification obligations under the Personal Data Protection Law along with related regulations under the Cybersecurity Law, on top of the risk of losing customer and partner trust. In practice, the biggest damage is usually not the money lost at the moment of the incident, but the operational downtime and the cost of rebuilding trust afterward, costs that are hard to measure immediately but last far longer.
Effective defense requires combining individual level actions with technical measures at the enterprise level.
Instead of clicking directly on a link sent to them, users should open their browser and type in the official address of ChatGPT, Claude, or DeepSeek themselves to check account notifications. This simple habit completely eliminates the risk of being led through a malicious redirect chain.
No reputable AI platform will ask you to update your credit card details or confirm your password through a link in an email. If you receive such a request, the safest approach is to ignore the link and log in directly through the official homepage to check your account.
Two factor authentication (2FA) helps reduce risk even if a password has been exposed, though it is not fully immune to AiTM techniques. When you receive an urgent warning such as an account lock or a policy violation, verify it directly through an official support channel instead of immediately following the instructions in the email.
Avoid downloading AI tools from advertising links, social media posts of unclear origin, or GitHub repositories that do not belong to the official development organization, even when the interface and benchmark figures look credible.
The three protocols SPF, DKIM, and DMARC help verify that an outgoing email truly originates from a legitimate domain, blocking most domain spoofing emails before they ever reach a recipient’s inbox. This is also the foundational technical step that any business should implement first.
Beyond technical controls, businesses need to maintain continuous anomaly monitoring across email flows and run regular cybersecurity awareness training for employees, with particular attention to new scam tactics tied to popular AI brands. The most effective approach is not to generically tell employees to “be more careful,” but to minimize the number of situations where an employee has to make a correct or incorrect judgment call in just a few seconds, by pushing technical filtering earlier in the email infrastructure layer.
As AI brand impersonation phishing campaigns grow more sophisticated and harder to spot with the naked eye or traditional spam filters, businesses need a proactive defense layer at the email infrastructure level rather than relying solely on individual employee vigilance.
VNETWORK’s EG-Platform is an email security platform that applies AI and machine learning to provide comprehensive protection for both incoming and outgoing email. The solution helps prevent phishing, social engineering, and targeted email attacks. Notably, EG-Platform is an email security platform that fully meets the ITU-T X.1236 standard set by the International Telecommunication Union.
EG-Platform operates on a three layer protection model:
Thanks to this three layer model, EG-Platform can detect sophisticated phishing campaigns early, before they cause damage, including redirect chains and fake login pages like those analyzed in the ChatGPT and Claude impersonation campaigns above, while also meeting international email security standards, making it suitable for businesses with high requirements for information security and regulatory compliance.
AI brands will almost certainly remain a favorite lure for cybercriminals going forward. This is not a passing trend but an inevitable consequence of AI’s adoption speed far outpacing most users’ security awareness. The three ChatGPT, Claude, and DeepSeek impersonation campaigns analyzed in this article are just the representative examples that have been detected, and many similar variants targeting other AI brands are likely still quietly underway.
For businesses, proactively equipping a strong enough email security layer at the infrastructure level is a necessary step so that data safety does not depend on the split second vigilance of individual employees. Contact the VNETWORK team today for advice on an EG-Platform solution suited to your business’s scale and email security needs.
Official emails from these AI platforms never ask you to update card details or confirm a password through a link in the email. The safest approach is to carefully check the sender’s domain and always log in directly through the official homepage rather than clicking the link sent to you.
Change the password immediately on the affected account and on any other account that shares that password, enable two factor authentication if you have not already, and check your login history and linked devices for signs of unusual access.
Traditional phishing only steals passwords, whereas the Adversary in the Middle technique steals the authenticated session token directly. This lets the attacker keep access even when the account has multi factor authentication enabled, because the token functions as a valid, already logged in session.
The foundational step to implement first is email authentication through the SPF, DKIM, and DMARC protocols, since this technical layer blocks most domain spoofing emails before they ever reach employees.
EG-Platform combines three layers, SpamGUARD, ReceiveGUARD, and SendGUARD, applying AI and machine learning to score risk and check domain authentication standards, while sandboxing analyzes URLs and attachments before an email ever reaches the user, helping to detect sophisticated AI brand impersonation phishing campaigns early.