{
 "public_id": "AIR-2026-0066",
 "incident_id": "2026-03-pillar-ai-coding-tool-malvertising",
 "date_disclosed": "2026-03-10",
 "date_occurred": "2025-02",
 "title": "Twenty malvertising and marketplace-poisoning campaigns impersonating AI coding tools (Feb 2025 - Mar 2026)",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "malvertising_seo_poisoning_and_marketplace_impersonation",
 "agent_capability_abused": [
  "developer_trust_in_agent_tooling"
 ],
 "target_product": "ChatGPT, Cursor IDE, Claude / Claude Code, DeepSeek, Grok, OpenClaw, Gemini, VS Code AI extensions and others",
 "target_vendor": "multiple (impersonated)",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "credential_theft",
  "ransomware",
  "data_exfiltration"
 ],
 "blast_radius": "1.5M downloads via VS Code AI extensions; a Microsoft-reported extension campaign hit 900,000 installs across 20,000+ enterprise tenants; AiFrame 260,000 users",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI04",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "malvertising",
   "seo_poisoning",
   "brand_impersonation",
   "extension_marketplace_poisoning",
   "ai_search_poisoning"
  ]
 },
 "defense_present": "ad-network and marketplace review",
 "defense_bypassed": true,
 "fix_shipped": "ongoing takedowns",
 "primary_sources": [
  "https://www.pillar.security/blog/ai-coding-tools-under-fire-mapping-the-malvertising-campaigns-targeting-the-vibe-coding-ecosystem"
 ],
 "verified_quote": "The first 10 weeks of 2026 have already produced more campaigns than all of 2025 combined.",
 "confidence": "high",
 "notes": "Pillar Security landscape mapping of at least 20 distinct campaigns across five vectors: search malvertising (7), trusted-domain abuse (3), extension marketplace poisoning (6), fake download sites (5) and an npm supply chain campaign against Cursor (1). Payloads included AMOS, Amatera Stealer, Vidar, GhostSocks, XWORM and the Lucky_Gh0$t and CyberLock ransomware. Also documents Bing AI search results being poisoned simply by hosting malware on GitHub. This is an umbrella record; individual campaigns have their own records where verified.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "brand_trust"
 ],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Ransomware & Extortion"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": true,
 "agency_reason": "malvertising and marketplace poisoning exploiting trust in AI tooling brands",
 "vector_family": "other",
 "vector_detail": "malvertising_seo_poisoning_and_marketplace_impersonation",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "credential_theft",
  "data_exfiltration_channels"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI04 (eai_category=supply_chain_vulnerabilities), ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}