Campaign Redirects Users from 186 Fake AI Domains to ClickFix Lures, Browser Hijackers, and Malicious Extensions
Cybersecurity researchers identified a large-scale campaign exploiting 186 lookalike domains mimicking popular AI tools such as ChatGPT, Anthropic Claude, and Microsoft Copilot. These domains redirect users to deceptive ClickFix lures deploying PowerShell commands, fake security check pages delivering the Net Guard browser-hijacking malware, or search-hijacking browser extensions with nearly one million users. The campaign, dubbed TypoPrompting, abuses parked domains and weaponizes legitimate business models for abuse by redirecting traffic through complex distribution systems. Notable tactics include fingerprinting visitors and covertly changing browser search settings to exfiltrate sensitive data. The abuse affects diverse sectors due to impersonation of various trusted brands, presenting a considerable risk to users mistyping domain names for AI services.
Detalhes técnicos
The ClickFix lures use a fake Cloudflare verification page to deliver PowerShell and shell commands after fingerprinting the browser and collecting IP data. The Net Guard malware, although distributed as an unmodified Microsoft Store app, includes capabilities to run attacker-controlled JavaScript, alter default search engines, modify browser profiles, and install arbitrary Chrome extensions covertly. The search hijacking extensions, including "Quick Search" and "GPT for Chrome," override default search providers to send queries, possibly containing sensitive internal information, to third parties. The domains mimic 27 AI brands and some were first registered as early as July 2023.
Remediação
Users should verify domain names carefully when accessing AI services and avoid clicking prompts to run software or browser extensions from unexpected sites. Organizations should consider controls to detect and block traffic to known typo-squatting domains and monitor for unauthorized changes in browser configurations or the installation of suspicious extensions.
Linha do tempo
-
Campaign Redirects Users from 186 Fake AI Domains to ClickFix Lures, Browser Hijackers, and Malicious Extensions
ler a análise desta fonte ocultar
Cybersecurity researchers identified a large-scale campaign exploiting 186 lookalike domains mimicking popular AI tools such as ChatGPT, Anthropic Claude, and Microsoft Copilot. These domains redirect users to deceptive ClickFix lures deploying PowerShell commands, fake security check pages delivering the Net Guard browser-hijacking malware, or search-hijacking browser extensions with nearly one million users. The campaign, dubbed TypoPrompting, abuses parked domains and weaponizes legitimate business models for abuse by redirecting traffic through complex distribution systems. Notable tactics include fingerprinting visitors and covertly changing browser search settings to exfiltrate sensitive data. The abuse affects diverse sectors due to impersonation of various trusted brands, presenting a considerable risk to users mistyping domain names for AI services.
Technical Details
The ClickFix lures use a fake Cloudflare verification page to deliver PowerShell and shell commands after fingerprinting the browser and collecting IP data. The Net Guard malware, although distributed as an unmodified Microsoft Store app, includes capabilities to run attacker-controlled JavaScript, alter default search engines, modify browser profiles, and install arbitrary Chrome extensions covertly. The search hijacking extensions, including "Quick Search" and "GPT for Chrome," override default search providers to send queries, possibly containing sensitive internal information, to third parties. The domains mimic 27 AI brands and some were first registered as early as July 2023.
Remediation
Users should verify domain names carefully when accessing AI services and avoid clicking prompts to run software or browser extensions from unexpected sites. Organizations should consider controls to detect and block traffic to known typo-squatting domains and monitor for unauthorized changes in browser configurations or the installation of suspicious extensions.