186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers

Cybersecurity researchers have discovered fake domains that mimic artificial intelligence tools, redirecting users to malicious content. These domains serve ClickFix-style lures, browser malware, and extensions that hijack user searches. The tactic, known as TypoPrompting, involves creating lookalike domains that deceive users into verifying their identity when attempting to access a familiar tool. This delivery pattern is used to trick users into installing malware or revealing sensitive information. The fake domains are designed to appear as legitimate AI tools, making it difficult for users to distinguish between genuine and malicious sites. The researchers have identified a set of extensions that hijack user searches as part of this campaign.