AI Lookalike Domains Push ClickFix Malware and Browser Hijacks

Researchers at Island identified 186 domains impersonating 27 artificial-intelligence brands and traced them to ClickFix lures, browser-hijacking malware and search-hijacking extensions. The company calls the pattern TypoPrompting, describing how a mistyped address for a familiar AI service can send a visitor into a malware delivery chain. Its November 12 report lists lookalikes for ChatGPT, Claude, Gemini, Copilot, Grok, DeepSeek, Perplexity and other tools. Island said the 186-domain figure counts lookalike addresses, not confirmed infections.

One route starts with a Claude lookalike and ends at a fake Cloudflare verification page. Island captured the page prompting Windows visitors to paste and run a PowerShell command that downloads a script and launches it with a hidden window and execution-policy bypass. The same delivery kit also serves macOS Terminal or security-update prompts and archive downloads, with a wider set of 211 entry domains that also imitate banks, insurers and enterprise software.

Another route leads to Net Guard through fake security-check pages. The downloaded MSIX matches the hash of the genuine Microsoft Store package and carries Microsoft’s Marketplace signature, but Island’s analysis found the app can change browser search settings, run remotely supplied JavaScript through DevTools, edit browser profiles and install Chrome extensions. The company said these capabilities were enabled in the analyzed versions.

The third route uses a Perplexity lookalike to redirect visitors to Quick Search, a Chrome extension that replaces the browser’s default search provider without executable JavaScript or declared permissions. Island linked it to a wider family of 30 extensions; the remaining listings showed 972,000 declared users in total on November 3. That figure reflects store-listing claims, not a confirmed count of people who encountered the malicious domains or installed the extensions.

The activity uses typosquatting techniques to turn small typing errors into malicious redirects, while the fake brand identities resemble the brand-phishing campaigns targeting AI platforms seen elsewhere.

❤️

If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.

Support Us