TypoPrompting: 186 typosquatted domains impersonating 27 AI brands deliver ClickFix lures, Net Guard hijacker and search-hijacking extensions
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:07; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ thehackernews.com ↗
Researchers have documented a large-scale campaign dubbed TypoPrompting, in which 186 typosquatted domains impersonating 27 AI brands (including ChatGPT, Anthropic Claude, Microsoft Copilot and DeepSeek) redirect mistyped visits to malicious content (thehackernews.com, gbhackers.com). The research is credited to Oleg Zaytsev (gbhackers.com). Victims land on ClickFix lures that run PowerShell or shell commands, on fake security-check pages that deliver the Net Guard browser hijacker, or on search-hijacking browser extensions with nearly one million users (thehackernews.com). The campaign abuses parked domains and traffic distribution systems (TDS) that tailor the payload to each visitor and use cloaking to evade detection. Some domains were first registered as early as July 2023 (thehackernews.com). Earlier payloads served through similar typo domains included Aurora stealer and Android malware (gbhackers.com).
Detalhes técnicos
- Delivery chain: Parked domains redirect through several intermediate domains. The chain fingerprints the browser and collects IP data. Victims may have to solve a proof-of-work challenge before a convincing fake verification page asks them to run a copied command (gbhackers.com, thehackernews.com).
- ClickFix on Windows: The lure imitates a Cloudflare verification page. Payload scripts use curl and PowerShell with an execution-policy bypass, and hide from detection by using decimal IP notation (thehackernews.com, gbhackers.com).
- ClickFix on macOS: Victims get a fake Terminal update, with the payload piped into zsh (gbhackers.com).
- Net Guard: It is distributed as a Microsoft Store app and as MSIX packages that carry legitimate Microsoft signatures but act as browser hijackers (thehackernews.com, gbhackers.com). It can run attacker-controlled JavaScript, perform remote code evaluation, change the default search engine, modify browser profiles and silently install arbitrary Chrome extensions.
- Search-hijacking extensions: Extensions including "Quick Search" and "GPT for Chrome" override the default search provider without user permission. Queries, which may contain sensitive internal information, go to third parties (thehackernews.com, gbhackers.com).
Remediação
- Maintain allowlists or managed bookmarks of sanctioned AI tool domains. Monitor and block lookalike and known typosquatting domains (gbhackers.com, thehackernews.com).
- Tell users to check domain names carefully and never run commands or install software or extensions that an unexpected site prompts them to (thehackernews.com).
- Correlate Run dialog execution with browsing activity. Flag PowerShell execution-policy bypasses and decimal-IP usage (gbhackers.com).
- Enforce policies on browser search settings and extension installation. Monitor for unauthorized changes to browser configuration (gbhackers.com, thehackernews.com).
- Do not rely on signature verification alone. Use behavioral analysis of MSIX packages to detect hijackers (gbhackers.com).
Linha do tempo
-
TypoPrompting: Malicious Actors Exploit Typosquatting on AI Brand Domains to Deliver Malware and Hijack Browsers
ler a análise desta fonte ocultar
Cybersecurity researcher Oleg Zaytsev identified 186 typo-squatting domains mimicking 27 popular AI brands including ChatGPT, Claude, DeepSeek, and others. This attack pattern, dubbed TypoPrompting, leverages common typing errors to redirect visitors to malicious infrastructures that deliver browser-hijacking malware, search engine hijackers, and social engineering scams. The adversaries employ sophisticated delivery chains using traffic distribution systems that customize payload delivery based on visitor attributes, cloaking techniques to evade detection, and indirect payload delivery via scripts run from copied commands in fake verification pages.
The campaign heavily targets users of AI services like ChatGPT and Claude, with some typosquatting domains hosting malware like PowerShell scripts that bypass typical detection by using decimal IP notation and hidden execution policies. MacOS victims are targeted with fake Terminal updates exploiting shell commands. Additionally, malicious MSIX packages signed by Microsoft but acting as browser hijackers have been distributed through these typosquatting URLs. Some extensions installed change search providers without user permissions. Past payloads include Aurora stealer and Android malware distributed via similar typo domains.
Technical Details
The attack chain involves parked domains redirecting users through multiple domains, fingerprinting browsers, and requiring victims to solve proof-of-work challenges before seeing fake but convincing pages prompting them to run commands. Payload scripts executed with execution-policy bypass on Windows leverage curl and PowerShell, while macOS users are delivered fake updates piped into zsh. Malicious MSIX apps are bundled with legitimate signatures but perform unauthorized search engine modifications and remote code evaluations.
Remediation
Defenders are advised to maintain whitelists or managed bookmarks of sanctioned AI tool domains, monitor domain lookalikes, correlate unusual Run dialog execution with browsing behaviors, and flag PowerShell execution policies and decimal IP usage. Policies enforcing controlled browser search and extension installations are recommended, alongside endpoint visibility to track browsing to payload deployment paths. Signature verification alone is insufficient; behavioral analysis of MSIX packages is necessary to detect hijackers.
-
Campaign Redirects Users from 186 Fake AI Domains to ClickFix Lures, Browser Hijackers, and Malicious Extensions
ler a análise desta fonte ocultar
Cybersecurity researchers identified a large-scale campaign exploiting 186 lookalike domains mimicking popular AI tools such as ChatGPT, Anthropic Claude, and Microsoft Copilot. These domains redirect users to deceptive ClickFix lures deploying PowerShell commands, fake security check pages delivering the Net Guard browser-hijacking malware, or search-hijacking browser extensions with nearly one million users. The campaign, dubbed TypoPrompting, abuses parked domains and weaponizes legitimate business models for abuse by redirecting traffic through complex distribution systems. Notable tactics include fingerprinting visitors and covertly changing browser search settings to exfiltrate sensitive data. The abuse affects diverse sectors due to impersonation of various trusted brands, presenting a considerable risk to users mistyping domain names for AI services.
Technical Details
The ClickFix lures use a fake Cloudflare verification page to deliver PowerShell and shell commands after fingerprinting the browser and collecting IP data. The Net Guard malware, although distributed as an unmodified Microsoft Store app, includes capabilities to run attacker-controlled JavaScript, alter default search engines, modify browser profiles, and install arbitrary Chrome extensions covertly. The search hijacking extensions, including "Quick Search" and "GPT for Chrome," override default search providers to send queries, possibly containing sensitive internal information, to third parties. The domains mimic 27 AI brands and some were first registered as early as July 2023.
Remediation
Users should verify domain names carefully when accessing AI services and avoid clicking prompts to run software or browser extensions from unexpected sites. Organizations should consider controls to detect and block traffic to known typo-squatting domains and monitor for unauthorized changes in browser configurations or the installation of suspicious extensions.