186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
186 fake AI domains redirect users to malware, search hijackers, and click-lures.
Cybersecurity researchers have identified 186 fake domains impersonating popular AI tools, redirecting users to malicious content. These domains, part of a campaign codenamed TypoPrompting, serve ClickFix lures, browser-hijacking malware like Net Guard, and search-hijacking extensions. Some domains were registered as early as July 2023.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Claude?
Get an email when a new story names Claude, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers registered 186 domains impersonating popular AI tools, exploiting user trust and typographical errors to redirect victims to ClickFix lures, browser hijackers, and malicious extensions. This campaign, dubbed TypoPrompting, succeeded primarily because end users cannot reliably distinguish legitimate AI tool domains from convincing fakes. The browser-based malware installed as a result can silently manipulate search results and exfiltrate user data. This matters because the attack requires no software vulnerability — only a user's moment of inattention — making human awareness and technical safeguards both essential defenses.
What helps against this
How we list vendors- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — cloude.ai
- domain — cluade.ai
- domain — clsude.ai
- domain — chatlgpt.com
- domain — geimini.com
- domain — notebookklm.com
- domain — griok.com
- domain — preplexity.ai
- domain — deepceek.com
- domain — elevenlebs.io
- domain — copiot.com
- domain — midj0urney.org
- malware — Net Guard
- domain — find.flashysearches.com