Recent cyberattacks highlight a disturbing trend: threat actors are exploiting the inherent trust users have in widely used platforms like Google Ads and GitLab to execute malicious commands. Rather than deploying traditional malware techniques, these attackers opted for a more deceptive method, tricking users into copy-pasting harmful commands from legitimate-looking sources.
Researchers from TrendAI reported that this malicious campaign led over 2,000 victims from sponsored search results for popular AI developer tools to deceptive download pages. The attackers even utilized the shared chat feature of Claude, an AI platform, as a crucial step in their assault chain.
Decoding the Six-Wave Campaign
Notably, this attack chain differed from previous campaigns that typically relied on dubious domains. Instead, it incorporated 92 unique malicious hostnames across GitLab pages while impersonating credible brands such as ChatGPT, Cursor IDE, and Claude AI. The campaign unfolded over seven weeks, incrementally introducing new pages and keywords.
The initial wave ran from April 8-13, prominently featuring claude-code-app.gitlab.io. This phase also included utility-themed lures like mac-clean-storage.gitlab.io. A particular Google Ads campaign ID (23736589328) proved instrumental in attracting most victims during this period.
Subsequent waves progressively diversified. The second wave saw Claude-themed entities like claude-tool-app emerge, coupled with expanded Mac utility lures. In wave three, brand impersonation intensified with the introduction of perplexity-platform.gitlab.io and chatgpt-codex.gitlab.io.
Between April 29 and May 5, wave four shifted focus towards popular AI technologies, launching variants like codexgpt.gitlab.io and others themed around ChatGPT. By the fifth wave (May 6-14), attackers pivoted fully to exploiting Claude's shared chat feature, generating persistent and publicly accessible links that were weaponized via Google Ads.
By the final wave, spanning May 21 to June 14, the campaign exclusively targeted Claude’s shared chat, solidifying its grip on unsuspecting developers.
Why Reputation-Based Defenses Failed
The success of this campaign illustrates a critical flaw in existing security protocols. By relying on trusted platforms throughout the attack sequence, attackers made their actions appear as standard user behavior. Amit Jaju from Ankura Consulting pointed out that this strategy effectively eliminates the psychological hesitations that victims ordinarily experience when engaging with suspicious links.
"This attack chain doesn’t require victims to trust something overtly suspicious," Jaju explained. "Instead, it capitalizes on the trust built around well-established brands, reputable hosting services, and AI tools that developers frequently use." This phenomenon, termed “trust stacking,” blurs the lines between legitimate and malicious activity significantly.
As organizations may not wish to block access to trusted applications like Google and GitLab for operational efficiency, they inadvertently expose themselves to potential threats. The safety measures based on reputation fall short in this context, compelling security teams to scrutinize user actions more deeply.
Disrupting the Attack Chain
The implications of such an attack are alarmingly significant, particularly for developers. Insider threats can stem from compromised developer machines, which may retain sensitive information such as browser session cookies, SSH keys, and cloud credentials. This vulnerability allows attackers to infiltrate code repositories, CI/CD pipelines, and enterprise systems much more easily than one might assume.
Despite the dependence on trusted platforms, organizations can still take proactive measures to disrupt these attacks. Notably, limiting administrative privileges and monitoring PowerShell or shell executions can create barriers against such infiltration.
Dhar emphasized that understanding modern threats requires realizing that not all cyberattacks necessitate the delivery of harmful software. Increasingly, attackers employ psychological manipulation to coerce users into executing commands themselves. Therefore, it’s advisable to enforce stricter governance around access, implement least privilege models, and segment development environments from general browsing.
In summary, while not foolproof, recognizing and fortifying defenses against social engineering tactics can help organizations mitigate risks associated with these sophisticated cyber threats.
