186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers Ravie LakshmananNov 12, 2026Browser Security / Web Security Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches. This delivery pattern has been codenamed TypoPrompting by Island. "AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install or run something else," the cybersecurity company said in a report shared with The Hacker News. In all, the campaign spans 186 bogus domains spanning 27 AI brands, including Anthropic Claude, OpenAI ChatGPT, Google Gemini and Gemini Notebook (formerly NotebookLM), Microsoft Copilot, SpaceXAI Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, and Cursor. While one category leads to a ClickFix lure that serves a PowerShell command via a fake Cloudflare verification page, the second route takes unsuspecting users to "Security Check" pages that deliver a browser-hijacking malware called Net Guard. The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users. Some of the AI lookalike domains are listed below - An analysis of registration records shows that some of these domains, like cloude[.]ai and cluade[.]ai, were registered as early as July 13, 2023. The use of parked domains for malware delivery is not new. In December 2025, Infoblox highlighted how domains without a current web page can be monetized to redirect visitors to sites that serve scams and malware after profiling the host and the device they are visiting from. "When a domain owner opts into direct search, traffic to the domain is sold to advertisers who bid on keywords and traffic characteristics," the DNS threat intelligence firm noted at the time. "In practice, the site visitor is usually funneled through a series of traffic distribution systems (TDSs) operated by third-party advertising platforms, creating a complex web where a legitimate business model is weaponized for abuse." In the case of the ClickFix route, the parked page initiates a redirect chain that fingerprints the web browser and collects the public IP address before displaying the fake Cloudflare verification page. Island said the fingerprint gate script spans a broader set of 211 entry domains, including lookalikes of banks, insurers, and enterprise software, such as Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow, and Microsoft Azure. These domains serve three types of lures - Fake verification pages on Windows that are designed to run a clipboard command Terminal or security updates on macOS that are designed to run a shell command Archive download pages that instruct users to extract and run an executable Separately, eight typosquat domains for Claude, DeepSeek, Copilot, ElevenLabs, and Voice AI lead to fake "Security Check" pages that ultimately deliver Net Guard. While the app purports to be a Wi-Fi and DNS safety scanner and matches the MSIX hash for a legitimate app of the same name, it contains capabilities to run attacker-controlled JavaScript, change the default search engine while the user is idle, edit browser profiles, and install arbitrary Chrome extensions. "The download from the 'Security Check' pages is the Microsoft Store app itself, unmodified," Oleg Zaytsev, Lead Security Researcher at Island, told The Hacker News. "It is byte-for-byte identical to Net Guard as Microsoft distributes it, and it carries Microsoft’s own Store signature." "The hidden browser control comes with every copy, whether installed from the Store or from a typo site, and it switches itself on without asking. It waits until the user stops using the computer, then takes over Chrome's search settings and can run scripts inside the browser, following instructions from the operator's server." The third route revolves around a lookalike domain for Perplexity ("preplexity[.]ai"), which redirects the browser to a browser extension called Quick Search that's available on the Chrome Web Store. "The analyzed extension needs no executable JavaScript or declared permissions to perform its main action," Island said. "Its manifest overrides the default search provider with find.flashysearches[.]com . Searches made through that provider are sent to a third party. In a workplace, those queries can include internal hostnames, customer names and project details." Quick Search is part of a larger set of 16 extensions, including GPT for Chrome, which has 80,000 users. In all, the extensions collectively have 972,000 users as of November 3, 2026. "An address one letter away from an AI tool can lead to a very different request," Island said. "As these services become part of everyday work, reaching the right one should be a managed path, not a test of typing accuracy." (The story was updated after publication to include a response from Island.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, browser security, Malware, Phishing, Social Engineering, Web Security The Flood is Coming And The Pipes Were Already Full OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register Free Today Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk