# SZB-9d96703e23: Island reports 186 lookalike AI domains serving ClickFix lures and Net Guard malware

Island researchers report 186 lookalike domains impersonating 27 AI brands that serve ClickFix lures, browser-hijacking malware and search-hijacking extensions. The report says a search-hijack extension family has 16 live Chrome Web Store listings with 972,000 declared users.

- Type: Early warning
- Kind: Malicious package
- Vendor: Chrome Web Store
- Attacker tool: Net Guard, ClickFix
- Status: Corroborated
- Sources: 1 distinct
- First seen: 2026-11-12 16:10 UTC

> No statement or filing from Chrome Web Store has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Report the lookalike domains to the registrars and the impersonated AI brands
- Report the search-hijack extension listings to the Chrome Web Store for removal

## Timeline

- 2026-11-12 15:15 UTC: Made public by The Hacker News
- 2026-11-12 16:10 UTC: First seen by cve.now
- 2026-11-12 16:11 UTC: [Posted on X by cve.now](https://x.com/i/status/2120912281521340595)

## Evidence (1 source)

- 2026-11-12 · Press · [The Hacker News](https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html): “The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-9d96703e23&body=https%3A%2F%2Fcve.now%2FSZB-9d96703e23%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-9d96703e23

### Has Chrome Web Store confirmed it?

The Hacker News reports it. No statement from Chrome Web Store has reached cve.now yet.

Source: https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html

### What should Chrome Web Store users do?

Report the lookalike domains to the registrars and the impersonated AI brands. Report the search-hijack extension listings to the Chrome Web Store for removal.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-9d96703e23
Site guide for agents: https://cve.now/llms.txt