CONNECT WITH US
Cyber Security

Cyber Security

186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers

The Hacker News logo

Published on

Add as a preferred source on Google
186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers

Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches.

"AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install or run something else," the cybersecurity company said in a report shared with The Hacker News.

In all, the campaign spans 186 bogus domains spanning 27 AI brands, including Anthropic Claude, OpenAI ChatGPT, Google Gemini and Gemini Notebook (formerly NotebookLM), Microsoft Copilot, SpaceXAI Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, and Cursor.

While one category leads to a ClickFix lure that serves a PowerShell command via a fake Cloudflare verification page, the second route takes unsuspecting users to "Security Check" pages that deliver a browser-hijacking malware called Net Guard. The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users.

An analysis of registration records shows that some of these domains, like cloude[.]ai and cluade[.]ai, were registered as early as July 13, 2023.

The use of parked domains for malware delivery is not new. In December 2025, Infoblox highlighted how domains without a current web page can be monetized to redirect visitors to sites that serve scams and malware after profiling the host and the device they are visiting from.

"When a domain owner opts into direct search , traffic to the domain is sold to advertisers who bid on keywords and traffic characteristics," the DNS threat intelligence firm noted at the time.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.