TypoPrompting: Malicious Actors Exploit Typosquatting on AI Brand Domains to Deliver Malware and Hijack Browsers
Cybersecurity researcher Oleg Zaytsev identified 186 typo-squatting domains mimicking 27 popular AI brands including ChatGPT, Claude, DeepSeek, and others. This attack pattern, dubbed TypoPrompting, leverages common typing errors to redirect visitors to malicious infrastructures that deliver browser-hijacking malware, search engine hijackers, and social engineering scams. The adversaries employ sophisticated delivery chains using traffic distribution systems that customize payload delivery based on visitor attributes, cloaking techniques to evade detection, and indirect payload delivery via scripts run from copied commands in fake verification pages.
The campaign heavily targets users of AI services like ChatGPT and Claude, with some typosquatting domains hosting malware like PowerShell scripts that bypass typical detection by using decimal IP notation and hidden execution policies. MacOS victims are targeted with fake Terminal updates exploiting shell commands. Additionally, malicious MSIX packages signed by Microsoft but acting as browser hijackers have been distributed through these typosquatting URLs. Some extensions installed change search providers without user permissions. Past payloads include Aurora stealer and Android malware distributed via similar typo domains.
Detalhes técnicos
The attack chain involves parked domains redirecting users through multiple domains, fingerprinting browsers, and requiring victims to solve proof-of-work challenges before seeing fake but convincing pages prompting them to run commands. Payload scripts executed with execution-policy bypass on Windows leverage curl and PowerShell, while macOS users are delivered fake updates piped into zsh. Malicious MSIX apps are bundled with legitimate signatures but perform unauthorized search engine modifications and remote code evaluations.
Remediação
Defenders are advised to maintain whitelists or managed bookmarks of sanctioned AI tool domains, monitor domain lookalikes, correlate unusual Run dialog execution with browsing behaviors, and flag PowerShell execution policies and decimal IP usage. Policies enforcing controlled browser search and extension installations are recommended, alongside endpoint visibility to track browsing to payload deployment paths. Signature verification alone is insufficient; behavioral analysis of MSIX packages is necessary to detect hijackers.
Linha do tempo
-
TypoPrompting: Malicious Actors Exploit Typosquatting on AI Brand Domains to Deliver Malware and Hijack Browsers
ler a análise desta fonte ocultar
Cybersecurity researcher Oleg Zaytsev identified 186 typo-squatting domains mimicking 27 popular AI brands including ChatGPT, Claude, DeepSeek, and others. This attack pattern, dubbed TypoPrompting, leverages common typing errors to redirect visitors to malicious infrastructures that deliver browser-hijacking malware, search engine hijackers, and social engineering scams. The adversaries employ sophisticated delivery chains using traffic distribution systems that customize payload delivery based on visitor attributes, cloaking techniques to evade detection, and indirect payload delivery via scripts run from copied commands in fake verification pages.
The campaign heavily targets users of AI services like ChatGPT and Claude, with some typosquatting domains hosting malware like PowerShell scripts that bypass typical detection by using decimal IP notation and hidden execution policies. MacOS victims are targeted with fake Terminal updates exploiting shell commands. Additionally, malicious MSIX packages signed by Microsoft but acting as browser hijackers have been distributed through these typosquatting URLs. Some extensions installed change search providers without user permissions. Past payloads include Aurora stealer and Android malware distributed via similar typo domains.
Technical Details
The attack chain involves parked domains redirecting users through multiple domains, fingerprinting browsers, and requiring victims to solve proof-of-work challenges before seeing fake but convincing pages prompting them to run commands. Payload scripts executed with execution-policy bypass on Windows leverage curl and PowerShell, while macOS users are delivered fake updates piped into zsh. Malicious MSIX apps are bundled with legitimate signatures but perform unauthorized search engine modifications and remote code evaluations.
Remediation
Defenders are advised to maintain whitelists or managed bookmarks of sanctioned AI tool domains, monitor domain lookalikes, correlate unusual Run dialog execution with browsing behaviors, and flag PowerShell execution policies and decimal IP usage. Policies enforcing controlled browser search and extension installations are recommended, alongside endpoint visibility to track browsing to payload deployment paths. Signature verification alone is insufficient; behavioral analysis of MSIX packages is necessary to detect hijackers.