A gray-market service persuaded employees to install genuine OpenAI Codex and Anthropic Claude Code tools, then run a follow-up setup command that redirected the tools through relay servers it controlled. The configuration changes could expose every prompt, file, and login token sent through the tools while disabling key safety settings. This is a real, user-driven installation workflow rather than a flaw in OpenAI or Anthropic products.
Employees who could not buy Western AI coding tools directly turned to gray-market resellers for access. The workflow began normally: a user installed the genuine OpenAI Codex or Anthropic Claude Code tool with a standard npm command. Shortly afterward, often within minutes or up to half an hour, the same user ran a one-line setup command supplied by the reseller or relay service. That command pulled a script from a lookalike domain such as vibe.aiok[.]me and executed it immediately using PowerShell's iwr piped to iex or a shell's curl piped to bash.
The script ran in memory without saving a file, checked for Node.js and the AI tool, and installed missing pieces quietly. It then altered the tool's configuration files, user-level environment variables, sandbox settings, network access, and telemetry settings, rerouting the tool's base URL and credentials to infrastructure the relay operator controlled.
The trust that made this work had little to do with technical deception and everything to do with access scarcity and convenience. Because employees in affected regions could not obtain these tools through normal channels, they relied on resellers and accepted setup instructions at face value. Running a ready-made one-line command after a legitimate npm install felt like a routine continuation of installation rather than a separate, risky action. Since the underlying AI tools were genuine, there was no obviously fake product to raise suspicion.
Organizations can reduce exposure by limiting AI developer tool installation and configuration to approved company channels, and by treating any command that downloads and immediately executes a remote script as high-risk, even when the underlying tool is legitimate. Employees should avoid entering source code, files, or credentials into AI tools whose service endpoint has not been verified as the approved one. Any unexpected configuration change, logout prompt, or request to reconnect an AI tool account should be reported rather than acted on immediately, since a relay in this position can see every prompt, file, and secret sent to the tool and can alter or invent its replies.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a scheme where a gray-market service persuades employees to install genuine OpenAI Codex or Anthropic Claude Code tools, then run a follow-up setup command that redirects the tools through relay servers the operator controls.
No, this is a real, user-driven installation workflow rather than a flaw in OpenAI or Anthropic products.
The modified configuration could expose prompts, files, secrets, and authentication tokens sent through the tools, and the relay could change or invent replies.
Symantec observed the configuration changes but found no evidence that the operator had yet used the access to execute malicious commands or steal data.
Installed genuine Codex or Claude Code? The next command is the trap. A reseller says, ‘Run this one-line setup command.’ It pulls a script from vibe.aiok.me using curl-pipe-bash or PowerShell iwr-pipe-iex. Aha: the tool stays genuine, but its destination changes. The script redirects its base URL and credentials to the relay, exposing prompts, files, and tokens. A normal install doesn't make that follow-up safe. Configure AI tools only through approved company channels.
Amatera is a subscription-based information stealer that affiliates distribute through fake AI-tool download pages, compromised websites, paid search ads, phishing, and deceptive ClickFix prompts. The scams convince people to copy and run a command to supposedly fix a CAPTCHA, browser error, or…
Attackers used paid Google ads to direct people to fake Claude download pages hosted on Anthropic’s real claude.ai website. The pages used a ClickFix trick: they told Mac and Windows users to paste a command into their device, installing password- and cryptocurrency-stealing malware. Because the…
Attackers used GitHub and search results to promote counterfeit ChatGPT and Claude desktop downloads. The ZIP files bundled real signed OpenAI or Anthropic executables with malicious files, tricking Windows users into launching malware that can persist on the device and install a cryptocurrency…
Attackers used fake ChatGPT, Claude, and Cursor AI application listings to trick Windows users into downloading malware. The downloads appeared trustworthy because they were hosted through GitHub and included real, digitally signed OpenAI or Anthropic executables, but malicious files alongside them…
Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.
A threat actor impersonated about 32 AI bots, including ones claiming to represent OpenAI, Anthropic, Meta, and Perplexity, to probe enterprise web servers for exposed credentials and private keys. The scanner relied on easily forged bot identity labels and rapidly requested common secret-file…
