Why scammers impersonate AI assistants
AI chatbots are the fastest-growing category of mass-market apps in recent years, and that popularity has a downside: almost every smartphone user recognizes the names ChatGPT, Claude, and Gemini, which makes the brand itself useful cover for scammers. People see a familiar name and logo and skip checking the actual developer, because "it's just ChatGPT."
A second driver is the expectation of free premium access. Paid subscriptions to flagship models cost real money, so ads promising "GPT-5 Plus for free" or "unlimited DeepSeek, no signup" hit exactly that desire. A third driver is the absence of an official client where users expect one — several AI services went a long time without a native Windows app, and scammers filled that gap with their own fake "desktop client" that has nothing to do with the real developer.
Kaspersky's numbers show the scale: since the start of 2026, roughly 92,000 attacks using malware disguised as AI services have been identified, with 49% impersonating ChatGPT and Claude and Gemini each accounting for 18%. These are banking trojans, spyware, and loaders that download additional malicious modules after installation.
The main types of fake AI apps
Fake AI apps aren't a single scheme — they spread through every channel an ordinary user relies on: app stores, search, ads, and messengers.
Fake apps and APKs in app stores
Clones of AI assistants periodically pass moderation on Google Play and show up in third-party APK catalogs. They copy the original's icon and name, sometimes adding words like "Pro," "Plus," or "AI Chat," and either charge for a nonexistent "premium" tier or hide a trojan under the hood.
Phishing look-alike sites and typosquatting
Securelist documented fake DeepSeek and Grok sites on clone domains such as r1-deepseek[.]net or v3-deepseek[.]com — visually indistinguishable from the original and promoted through search ads and social media posts.
"Desktop clients" for Windows
A specific pattern is an offer to download a "Windows client" for a service that has no official native Windows app at all. That's exactly how a malicious DeepSeek "client" with a built-in infostealer spread, and in May 2026 the Silver Fox group distributed fake Claude AI apps that granted long-term remote access to the system.
Messenger bots offering "free GPT-5/Plus"
Telegram and similar messengers host bots promising free access to top-tier models. The bot itself may not contain malicious code, but the risk is in what it asks you to do next: click a link to an APK, pay for "activation," or enter card details.
Fake Custom GPTs and "outage" pages
An October 2026 Huntress investigation describes a fake Custom GPT called "Plus 5.6" hosted on the genuine chatgpt.com domain. Victims saw a "service outage" message, followed by a fake verification page asking them to paste a command into the Windows console. The result was a remote-access tool (RAT) with access to files, screen, camera, and microphone; Huntress linked at least 40 incidents to this domain.
Search engine ads
Ad slots with fake "ChatGPT" links are another channel: the ad looks like an official link but leads to a clone or directly to a malicious download.
| Type of fake | How it spreads | What it does | Main tell |
|---|---|---|---|
| App/APK in a store | Google Play, third-party APK catalogs | Charges for a fake "subscription" or hides a trojan | Developer name doesn't match the official one |
| Look-alike site (typosquatting) | Search ads, social media posts | Phishes data, serves a malicious "client" | Domain differs by a character or word |
| "Client" for Windows | Search, forums, ads | Infostealer, remote-access backdoor | The service has no official Windows client |
| Messenger bot | Telegram and similar apps | Links to an APK or requests payment | Asks you to click a link or pay for "activation" |
| Fake Custom GPT / "outage" | Genuine service domain, mass messages | RAT with screen and camera access | Asks you to paste a command into a console/terminal |
What gets stolen and why it matters
Behind a convincing AI app icon can be any of the common malware families, each with its own damage scenario.
- Infostealers read saved passwords, browser cookies, and crypto wallet data straight off the device, leading to account takeovers (see infostealer malware explained).
- Banking trojans with screen overlays display a fake window on top of your real banking app and capture whatever you type (see how overlay attacks work).
- Remote access tools (RATs) give an attacker control of your screen, camera, and microphone without your involvement.
- Premium SMS subscriptions quietly sign your number up for paid services and drain your carrier balance.
- Contact and message harvesting — some samples, in the Spynote family style, exfiltrate the entire call log, contact list, and SMS history.
The "image search" scheme and the fake bank call
Russian security firm F6 and app marketplace RuStore warned in October 2026 about a specific multi-step scheme that starts with a seemingly innocent app.
- The victim installs an APK disguised as an "image search" feature for an AI service, usually via a link from a messenger, SMS, or ad banner.
- The app asks the user to restart the device "to finish installation."
- After the restart, a fake message appears claiming to be from the bank, warning of "suspicious activity" on the account.
- The victim is asked to provide a bank security code and grant remote access to the device "for a security check."
- With the code and remote access in hand, the attackers control both the account and the device directly.
The one thing to remember from this scheme: a bank will never ask for a security code or one-time passcode through a third-party app or pop-up window — that only ever happens inside the official banking app or via a verified number from your card or statements.
How to tell a real AI app from a fake one
Checking takes under a minute once you know what to look for in the app listing and on the website itself.
- Developer name in the store listing — official apps list the actual company (OpenAI, Google LLC, Anthropic, DeepSeek, etc.), not a random personal account.
- Typos or extra words in the name — "ChatGPT Pro Free," "GPT-6 Unlimited" — real AI apps keep their names short, without marketing add-ons.
- Publish date and install count — a brand-new listing with a handful of reviews claiming to be a world-famous service is a red flag.
- Requested permissions — Android Accessibility access, device-administrator rights, or SMS access aren't needed by a chat assistant (see which app permissions are dangerous).
- Website domain — an extra letter, digit, or word instead of the official domain is classic typosquatting (see how to spot a fake website).
- A request to paste a command into "Run" or a terminal under the guise of a "check" or "fix" — an unmistakable sign of an attack similar in mechanics to a fake CAPTCHA ClickFix scam.
One more thing: a free "Plus" or "Pro" forever with no limits is a marketing trick none of the major AI developers actually offer, because running inference on their models costs them real money.
What a VPN protects against — and what it doesn't
An honest answer matters more than a reassuring one: a VPN solves network-layer problems, not antivirus problems. A VPN encrypts your traffic on public Wi-Fi, hides which sites you visit and which DNS queries your device sends from your ISP and the access point owner, and protects against interception on an unsecured network.
A VPN does not remove an installed trojan, does not stop a malicious app from sending stolen passwords to an attacker's server, and does not scan an APK before installation — those are jobs for antivirus software and basic source hygiene. It's also worth remembering that the VPN app itself should only come from an official source: fake VPN clients are their own, equally dangerous category (see malicious VPN apps).
Official LiMP VPN apps for Android, Windows, and Chrome are distributed only through the LiMP VPN downloads page — never through third-party catalogs or ad links.
If you already installed a fake AI app
Act quickly and in order, without panicking.
- Disconnect the device from the internet (airplane mode, or turn off Wi-Fi and mobile data).
- If the app was granted device-administrator rights, revoke them first in security settings — otherwise removal may fail.
- Uninstall the suspicious app completely.
- Check the list of apps with Accessibility access and disable anything unfamiliar.
- From a different, clean device, change the passwords for your email, banking apps, and AI service account, and review and close all active sessions.
- Call your bank using the number on the back of your card (not a number from an SMS or suspicious message) and flag the possible compromise.
- Check with your mobile carrier for any premium SMS subscriptions that may have been activated.
- Run a scan with Play Protect or antivirus software; if doubts remain, factory-reset the device.
Checklist: using AI chatbots safely
- Bookmark the official AI service's website and navigate there directly, not through search or an ad.
- Install apps only from Google Play, the Microsoft Store, or the developer's official site, checking the developer name on every install.
- Don't click ads or posts promising "Download ChatGPT for free" — go to the service through your bookmark instead.
- Never paste a command into a system console or terminal because a website, bot, or pop-up told you to.
- Enable two-factor authentication on your AI service account if it's supported.
- Don't keep APK files sent to you in chats "just in case" — delete them right after checking, or don't download them at all.
- Never give out your bank security code outside the official banking app.
- Use a VPN on public Wi-Fi — it won't stop a malicious app, but it closes the interception channel.
