Skip to main content
cve.nowby Sazabi
Menu
Early warnings

Early warning

Island reports 186 lookalike AI domains serving ClickFix lures and Net Guard malware

Island researchers report 186 lookalike domains impersonating 27 AI brands that serve ClickFix lures, browser-hijacking malware and search-hijacking extensions. The report says a search-hijack extension family has 16 live Chrome Web Store listings with 972,000 declared users.

SZB-9d96703e23Malicious packageCorroborated

Written by a model from the sources below. Verify against them.

Sources1Corroborated
Kind
Malicious package
Vendor
Chrome Web Store
Attacker tool
Net Guard, ClickFix
Status
Corroborated
First seen

What to do

  • Report the lookalike domains to the registrars and the impersonated AI brands

  • Report the search-hijack extension listings to the Chrome Web Store for removal

Timeline

  1. Made public by The Hacker News
  2. First seen by cve.now
  3. Posted on X by cve.now

Evidence 1

  1. Press
    The Hacker News
    “The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-9d96703e23

Has Chrome Web Store confirmed it?

The Hacker News reports it. No statement from Chrome Web Store has reached cve.now yet.Source: The Hacker News

What should Chrome Web Store users do?

Report the lookalike domains to the registrars and the impersonated AI brands. Report the search-hijack extension listings to the Chrome Web Store for removal.

Sources