Cybercriminals are launching increasing numbers of campaigns that impersonate Claude and ChatGPT, targeting enterprise developers and employees with ClickFix-style tactics.
ClickFix attacks work by tricking users into disabling security protections on their systems. Attackers create fake websites, emails, or messages that appear to come from legitimate AI platforms. When victims visit these fraudulent sites, they receive prompts to disable antivirus software, security warnings, or other protective mechanisms. Once users comply, attackers gain access to compromised systems.
The surge in these impersonation campaigns exploits the widespread adoption of AI tools in enterprise environments. Developers and technical employees frequently use Claude and ChatGPT for coding assistance and other work tasks. This familiarity makes employees more likely to trust communications that appear to originate from these platforms.
The attacks represent a convergence of two proven threat vectors. ClickFix tactics have proven effective against general populations. Combining these methods with impersonation of trusted AI brands amplifies their impact. Attackers craft convincing lures by mimicking the interfaces, branding, and communication styles of popular AI services.
Enterprise security teams face challenges defending against these campaigns. Employees who regularly interact with legitimate AI platforms may struggle to distinguish authentic communications from fraudulent ones. The technical nature of developer work can create additional vulnerabilities if workers are distracted or multitasking.
Organizations should implement email authentication controls and monitor for domains that closely resemble official Claude and ChatGPT services. Security awareness training focused on recognizing ClickFix tactics and verifying platform communications can reduce employee susceptibility to these attacks. Developers should also be advised to access AI platforms only through official websites and authenticated accounts, rather than clicking links in unsolicited messages.
The shift toward attacking developers through AI platform impersonation reflects attacker sophistication in targeting high-value enterprise