186 fake AI domains serve ClickFix lures and browser malware
Original title: 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
Island says the TypoPrompting paths also include Net Guard and 16 search-hijack extensions declaring 972,000 users.
Island reported a campaign it calls TypoPrompting: 186 lookalike domains for 27 AI brands redirect visitors to ClickFix lures, Net Guard, or search-hijacking Chrome extensions. One path fingerprints the browser, then shows a fake Cloudflare page that supplies a PowerShell command. Eight typosquats deliver Net Guard, while preplexity.ai leads to Quick Search, part of 16 extensions with 972,000 declared users as of November 3, 2026.
Unconfirmed: Extension user counts are declared store figures, not confirmed active infections.
- Lookalikes cover Claude, ChatGPT, Gemini, Copilot, Grok, DeepSeek, and others.
- Some domains, including cloude.ai, were registered as early as July 13, 2023.
- A fingerprint script spans 211 entry domains, including bank and insurer lookalikes.
- Net Guard can run attacker JavaScript, change search, and install Chrome extensions.
- Quick Search overrides search with find.flashysearches.com and needs no declared permissions.
Impact: Clipboard or shell commands, browser hijack, and search query theft
- 1.Avoid lookalike AI domains and do not run clipboard commands from verification pages.
- 2.Review Chrome for Quick Search, GPT for Chrome, and related search-hijack extensions.
- Vendors
- Products
- Chrome Web Store
- Malware
- Net GuardQuick Search
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | chatlgpt.com | ains are listed below - cloude[.]ai cluade[.]ai clsude[.]ai chatlgpt[.]com geimini[.]com notebookklm[.]com griok[.]com preplexity[.] |
| domain | cloude.ai | users. Some of the AI lookalike domains are listed below - cloude[.]ai cluade[.]ai clsude[.]ai chatlgpt[.]com geimini[.]com note |
| domain | clsude.ai | ookalike domains are listed below - cloude[.]ai cluade[.]ai clsude[.]ai chatlgpt[.]com geimini[.]com notebookklm[.]com griok[.]co |
| domain | cluade.ai | of the AI lookalike domains are listed below - cloude[.]ai cluade[.]ai clsude[.]ai chatlgpt[.]com geimini[.]com notebookklm[.]co |
| domain | copiot.com | griok[.]com preplexity[.]ai deepceek[.]com elevenlebs[.]io copiot[.]com midj0urney[.]org An analysis of registration records show |
| domain | deepceek.com | geimini[.]com notebookklm[.]com griok[.]com preplexity[.]ai deepceek[.]com elevenlebs[.]io copiot[.]com midj0urney[.]org An analysis |
| domain | elevenlebs.io | otebookklm[.]com griok[.]com preplexity[.]ai deepceek[.]com elevenlebs[.]io copiot[.]com midj0urney[.]org An analysis of registration |
| domain | flashysearches.com | ts manifest overrides the default search provider with find.flashysearches[.]com . Searches made through that provider are sent to a third |
| domain | geimini.com | below - cloude[.]ai cluade[.]ai clsude[.]ai chatlgpt[.]com geimini[.]com notebookklm[.]com griok[.]com preplexity[.]ai deepceek[.] |
| domain | griok.com | clsude[.]ai chatlgpt[.]com geimini[.]com notebookklm[.]com griok[.]com preplexity[.]ai deepceek[.]com elevenlebs[.]io copiot[.]c |
| domain | midj0urney.org | preplexity[.]ai deepceek[.]com elevenlebs[.]io copiot[.]com midj0urney[.]org An analysis of registration records shows that some of th |
| domain | notebookklm.com | e[.]ai cluade[.]ai clsude[.]ai chatlgpt[.]com geimini[.]com notebookklm[.]com griok[.]com preplexity[.]ai deepceek[.]com elevenlebs[.]i |
| domain | preplexity.ai | chatlgpt[.]com geimini[.]com notebookklm[.]com griok[.]com preplexity[.]ai deepceek[.]com elevenlebs[.]io copiot[.]com midj0urney[.] |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches. This delivery pattern has been codenamed TypoPrompting by Island. "AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.