Attackers are increasingly using fake AI software and lookalike downloads to infect business devices, according to new reporting cited by The Hacker News. The reported activity centres on campaigns impersonating popular AI products in order to deliver malware, steal browser sessions and compromise business accounts.

While the source data highlighted attacks observed against US organisations, the underlying technique is not specific to one market. For European companies rolling out AI tools across teams, the story is a practical reminder that demand for generative AI can quickly become a new entry point for cybercriminals.

What happened

The report says researchers at ANY.RUN linked 1,258 public sandbox analyses between April and October 2026 to fake AI-related campaigns. According to the source, attackers used the popularity of AI products as a lure to get users to download malicious files or interact with fraudulent software.

The reported objectives included malware delivery, browser session theft and account compromise. In practice, browser session theft can allow attackers to hijack authenticated sessions in business tools without immediately needing a password reset, which may increase the risk to cloud services, admin panels and SaaS platforms used by staff.

The source also notes increased operational pressure on managed security providers supporting affected businesses. Although the article refers specifically to US organisations, the attack method itself is relevant more broadly because many European SMEs are adopting AI tools quickly, often through individual team experimentation before formal security reviews are in place.

Why it matters for European businesses

For many SMEs, AI adoption is happening through browsers, desktop downloads, extensions, shared prompts and third-party SaaS tools. That creates several practical risks.

• AI interest is now a phishing lure: employees looking for productivity gains may be more likely to trust a site, ad, installer or social post claiming to offer a new AI assistant, model access or automation feature.
• Session theft can bypass normal assumptions: if attackers steal active browser tokens or cookies, business accounts in email, CRM, ad platforms, e-commerce systems or collaboration tools may be exposed even when teams use strong passwords.
• Shadow AI increases exposure: when staff test unofficial AI tools without procurement or IT review, companies may have limited visibility into what was installed, what permissions were granted and where company data was entered.
• Marketing and operations teams are likely targets: these teams often use multiple browser-based platforms, third-party integrations and shared accounts, which can make a single compromised session especially damaging.

For European businesses, the issue is not only endpoint security. It also affects data protection, account governance and supplier risk, especially when AI tools are connected to internal documents, customer data or automation workflows.

Who may be affected

• SMEs adopting generative AI tools for content, customer service, internal productivity or workflow automation
• Marketing teams using browser-based platforms, ad accounts, analytics tools and social media management software
• E-commerce businesses with admin access to storefronts, payment-related systems, product data and customer accounts
• IT and security teams managing SaaS access, browser policies, endpoint protection and employee software approvals
• Managed service providers and MSSPs responsible for monitoring suspicious downloads, browser compromise and account takeover activity

What companies should consider

• Tighten software approval processes: make it clear which AI tools are approved, where they may be downloaded from and who can authorise new tools.
• Review browser security controls: consider policies for extensions, downloads, local admin rights and detection of suspicious session theft behaviour.
• Strengthen account protection: use phishing-resistant authentication where possible, reduce shared accounts and review high-risk privileged access to ad platforms, CMSs, cloud dashboards and admin consoles.
• Monitor for shadow AI usage: identify unsanctioned AI apps or connectors being used by staff, particularly those requesting access to email, files or collaboration platforms.
• Train employees on AI-themed scams: update awareness programmes so staff recognise fake AI installers, lookalike websites and urgent claims about exclusive access or premium features.
• Prepare for session-based compromise: incident response plans should include revoking active sessions, rotating tokens, checking browser-stored credentials and reviewing suspicious SaaS logins.
• Assess third-party exposure: if agencies, freelancers or external providers access business platforms, confirm they follow similar controls around AI tool adoption and endpoint security.

The reported figures come from observed public sandbox analyses and should be read as an indicator of a broader threat trend rather than a complete measure of all incidents. Even so, the message for European businesses is clear: as AI tools become part of daily work, fake AI products are becoming a credible and increasingly practical cyberattack route.