thehackernews.com
Nov 12, 2026
186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
AI-summarised brief · reviewed before publication
Cybersecurity researchers uncovered a campaign using 186 fake domains that imitate popular AI tools to deliver malicious content. The attack, dubbed TypoPrompting, redirects users to ClickFix lures that run PowerShell commands, to “Security Check” pages that install Net Guard browser‑hijacking malware, or to search‑hijacking Chrome extensions. The malicious extensions, including Quick Search, have 972,000 users and redirect queries to third‑party sites, potentially exposing sensitive workplace data. The domains target 27 AI brands, such as OpenAI, Anthropic, and Google Gemini.
💡 Why It Matters
- · The scale of the attack—spanning hundreds of domains and nearly a million extension users—exposes a new vector for data exfiltration and corporate espionage.
- · It underscores the urgency for stricter domain verification and user education around AI‑related URLs.
