[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f83SpPEN-UQRH0LdM5Sbcv1X05BhMJaPZ7Vj1NdWZalk":3},{"article":4,"iocs":53,"watch_terms":86,"solutions":87,"lesson":171},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"63025e7b-deb3-451b-8df5-1fd4a598f352","186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers","186-fake-ai-domains-redirect-users-to-clickfix-lures-browser-malware-and-search-9d9670","Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches. This delivery pattern has been codenamed TypoPrompting by Island. \"AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify,","Cybersecurity researchers have identified 186 fake domains impersonating popular AI tools, redirecting users to malicious content. These domains, part of a campaign codenamed TypoPrompting, serve ClickFix lures, browser-hijacking malware like Net Guard, and search-hijacking extensions. Some domains were registered as early as July 2023.","186 fake AI domains redirect users to malware, search hijackers, and click-lures.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002F186-fake-ai-domains-redirect-users-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEirJnc36Fxj4oKOmKhcPvspB_xQpv3VgpXjYnu29SOv8NbVJHeaGNKT26851QIPQbHozxeF5vmq5otdRbJBKEaN9557MtuxLwp5fxX-pQVDVKwvZJtPR9ayT2Njx83svW7TVsVkVpFUOt5JHqhdSkSI7uV0d4dxlf5pWAmHISttTHWjURyOpuuy0CzVCSmK\u002Fs1600\u002Flauce.jpg","2026-11-12T15:15:40+00:00","2026-11-12T17:00:25.529227+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Claude","product",{"name":21,"type":19},"ChatGPT",{"name":23,"type":19},"Gemini",{"name":25,"type":19},"Gemini Notebook",{"name":27,"type":19},"Copilot",{"name":29,"type":19},"Grok","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,60,62,64,66,68,70,72,74,76,78,80,83],{"type":55,"value":56,"context":57},"domain","cloude.ai","Fake AI domain",{"type":55,"value":59,"context":57},"cluade.ai",{"type":55,"value":61,"context":57},"clsude.ai",{"type":55,"value":63,"context":57},"chatlgpt.com",{"type":55,"value":65,"context":57},"geimini.com",{"type":55,"value":67,"context":57},"notebookklm.com",{"type":55,"value":69,"context":57},"griok.com",{"type":55,"value":71,"context":57},"preplexity.ai",{"type":55,"value":73,"context":57},"deepceek.com",{"type":55,"value":75,"context":57},"elevenlebs.io",{"type":55,"value":77,"context":57},"copiot.com",{"type":55,"value":79,"context":57},"midj0urney.org",{"type":50,"value":81,"context":82},"Net Guard","Browser-hijacking malware",{"type":55,"value":84,"context":85},"find.flashysearches.com","Default search provider for Quick Search extension",[18,21,23],{"controls":88,"vendors":170},[89,116,145],{"slug":90,"name":91,"problem":92,"products":93},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[94,102,108],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":103,"product_name":104,"url":106,"description":107},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"slug":117,"name":118,"problem":119,"products":120},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":146,"name":147,"problem":148,"products":149},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[150,156,163],{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":151,"product_name":152,"url":154,"description":155},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":146,"product_name":160,"url":161,"description":162},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":164,"product_name":167,"url":168,"description":169},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":172,"title":173,"body":174,"framework_refs":175,"framework_notes":181},"186-fake-ai-domains-lure-users-into-installing-browser-malware","186 Fake AI Domains Lure Users Into Installing Browser Malware","Attackers registered 186 domains impersonating popular AI tools, exploiting user trust and typographical errors to redirect victims to ClickFix lures, browser hijackers, and malicious extensions. This campaign, dubbed TypoPrompting, succeeded primarily because end users cannot reliably distinguish legitimate AI tool domains from convincing fakes. The browser-based malware installed as a result can silently manipulate search results and exfiltrate user data. This matters because the attack requires no software vulnerability — only a user's moment of inattention — making human awareness and technical safeguards both essential defenses.",[176,177,178,179,180],"MITRE ATT&CK T1583.001: Acquire Infrastructure: Domains","MITRE ATT&CK T1176: Browser Extensions","CIS Control 9: Email and Web Browser Protections (v8)","NIS2 Article 21(2)(g)","NIST SP 800-53 SC-7: Boundary Protection",{"NIS2 Article 21(2)(g)":182,"MITRE ATT&CK T1176: Browser Extensions":183,"NIST SP 800-53 SC-7: Boundary Protection":184,"CIS Control 9: Email and Web Browser Protections (v8)":185,"MITRE ATT&CK T1583.001: Acquire Infrastructure: Domains":186},"This point mandates basic cyber hygiene and training, which is the primary defense against typosquatting and ClickFix social-engineering attacks that rely on users not recognizing malicious prompts.","The campaign delivered search-hijacking browser extensions (Net Guard) as a payload, which this technique covers as a method attackers use to establish persistence and manipulate browser behavior.","SC-7 requires filtering and monitoring of communications at system boundaries, which would enable organizations to block traffic to known malicious or lookalike domains before users are exposed.","CIS Control 9 requires organizations to filter and block access to malicious or uncategorized web domains, which would have prevented users from reaching the fake AI sites.","Attackers deliberately registered 186 lookalike domains to support the TypoPrompting campaign, which is exactly the infrastructure-acquisition technique this entry describes."]