186 Fake AI Domains Impersonate ChatGPT and Other Brands, Distributing Malware

On November 12, security company Island released a study revealing 186 domains impersonating 27 well-known AI brands, with ChatGPT being the most impersonated, having 25 similar domains. This was followed by Claude with 18, DeepSeek with 16, and Runway with 12. Among these similar domains, some redirect users to advertising pages, while others point to malicious websites. The study noted that attackers employ a technique called "TypoPrompting," exploiting users' spelling errors when entering AI tool URLs to carry out their attacks. Island tracked three attack paths associated with these domains: first, redirecting visitors to a fake Cloudflare verification page to entice Windows users into executing PowerShell commands; second, promoting a disguised application called Net Guard, masquerading as a "security check," which can hijack browsers and run remote scripts; third, involving 30 browser extensions that hijack searches, of which 13 have been removed, while the remaining 17 collectively have 972,000 users. Island stated that the 186 fake domains are a count of the number identified, not confirmed infection cases, and no losses from this activity have been confirmed so far.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.