Detect and disrupt AI-themed attacks with Microsoft Defender

Strategic summary

Microsoft Threat Intelligence has observed a growing set of campaigns impersonating popular AI platforms such as ChatGPT, Microsoft Copilot, DeepSeek, and Claude. Attackers use phishing, search-driven malware, and malvertising to steal credentials, credit card data, and access tokens. For organizations like Joel Traber AG, a manufacturing company in the DACH region, these AI-themed lures must be viewed as multi-stage attack chains rather than isolated events. Microsoft Defender provides integrated protection that can detect and disrupt these attacks early.

Key findings

• ChatGPT-themed phishing campaigns sent up to 100,000 emails in a single day to trick users into updating payment information and steal personal and credit card data.
• Threat actors impersonated AI brands including Claude, DeepSeek, and Microsoft Copilot through malvertising, fraudulent installers, and adversary-in-the-middle techniques.
• An initial access broker tracked as Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, showing rapid commoditization.
• These campaigns often follow a multi-stage path from email to malicious link, suspicious download, and finally identity or endpoint compromise.
• Microsoft Defender helps turn AI lures into dead ends by connecting signals across email, identity, endpoint, and cloud to stop attacks early.