Fake AI-tool installers and AI-ads invitations (Claude, ChatGPT, Gemini, Copilot, Codex, Ollama)

Pages that borrow the names of AI tools to get visitors to run malware or to hand over the Google or Meta Business account that runs their ads. Four page kits are tracked here. (1) Fake invitations to advertise on Gemini, Perplexity, ChatGPT, Claude or Meta's Muse: the page sends the visitor's IP address and location to its own back-end, checks whether that address is banned, and on 'Connect' draws a fake Google sign-in window inside the page (browser-in-the-browser) to collect the password. (2) Copies of the install pages of Claude Code, GitHub Copilot CLI, Ollama, OpenAI Codex and Kimi Code whose one-line install command points at the copy's own install.ps1. That script is the vendor's real installer with two lines added that start a hidden PowerShell window downloading further malware, so the developer still gets a working tool. (3) Copies of the 'Download Claude' page whose install command is kept encrypted in the page and is shown only after a click, in a pop-up telling the visitor to paste it into the Run box or Terminal. (4) Download pages for fake desktop apps (a budgeting app and others) whose installer is hosted on GitHub releases and whose download button reports each click to the operator's server. A match means a scan of one of these pages, a page that contacted one of the invitation kit's back-ends, or one of the altered install scripts.