In the wild
Realized harm
Twenty malvertising and marketplace-poisoning campaigns impersonating AI coding tools (Feb 2025 - Mar 2026)
AIR-2026-0066 AIR record · 2026-03-pillar-ai-coding-tool-malvertising
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The first 10 weeks of 2026 have already produced more campaigns than all of 2025 combined.pillar.security
The record
Disclosed
2026-03-10
Occurred
2025-02
Vendor
multiple (impersonated)
Product
ChatGPT, Cursor IDE, Claude / Claude Code, DeepSeek, Grok, OpenClaw, Gemini, VS Code AI extensions and others
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — malvertising and marketplace poisoning exploiting trust in AI tooling brands
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Malvertising seo poisoning and marketplace impersonation
Impact type
Credential theft, Ransomware, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
1.5M downloads via VS Code AI extensions; a Microsoft-reported extension campaign hit 900,000 installs across 20,000+ enterprise tenants; AiFrame 260,000 users
Capability abused
Defense & remediation
Recorded defense
ad-network and marketplace review
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
ongoing takedowns
Taxonomy & references
Curator notes
Pillar Security landscape mapping of at least 20 distinct campaigns across five vectors: search malvertising (7), trusted-domain abuse (3), extension marketplace poisoning (6), fake download sites (5) and an npm supply chain campaign against Cursor (1). Payloads included AMOS, Amatera Stealer, Vidar, GhostSocks, XWORM and the Lucky_Gh0$t and CyberLock ransomware. Also documents Bing AI search results being poisoned simply by hosting malware on GitHub. This is an umbrella record; individual campaigns have their own records where verified.
Supporting sources
Cite as
Enkrypt AI. "Twenty malvertising and marketplace-poisoning campaigns impersonating AI coding tools (Feb 2025 - Mar 2026)". AIR, AIR-2026-0066. https://agentincident.vercel.app/i/AIR-2026-0066/ (accessed 2026-10-19).