TypoPrompting: 186 Fake AI Domains Spread ClickFix Malware
A campaign dubbed TypoPrompting has weaponised 186 typosquatted domains impersonating major AI platforms—including ChatGPT, Claude, Gemini, and DeepSeek—to deliver ClickFix PowerShell lures, browser-hijacking malware (Net Guard), and search-hijacking Chrome extensions with nearly one million declared users. The attack exploits users' familiarity and trust in AI tooling brands to trigger malicious execution via fake verification flows. The breadth of the campaign—spanning 27 AI brands and multiple delivery pathways—indicates a mature, organised threat operation monetising AI brand equity for credential theft and persistent browser compromise.