Quick Search

186 TypoSquatted AI Domains Deliver ClickFix Lures, Net Guard Malware, and Search Hijacking Extensions

Cybersecurity researchers at Island have identified a large-scale campaign using 186 lookalike domains that impersonate popular AI tools from 27 brands. The operation, named TypoPrompting, routes visitors to ClickFix-style social engineering pages, the Net Guard browser hijacker, or malicious Chrome extensions that override search providers. Domains mimicking Anthropic Claude, OpenAI ChatGPT, Google Gemini, Microsoft Copilot, and others have been active since at least July 2023. One path leads through fingerprinting scripts to fake Cloudflare verification pages that execute PowerShell commands, while another delivers the Net Guard MSIX package capable of injecting JavaScript and altering browser settings. A third vector promotes 16 extensions, including Quick Search, that collectively claim nearly one million users and redirect queries to third-party services.