186 fake AI domains serve ClickFix lures and malware

Tier D · Background noise – Good to know

Who’s exposed: Developers and users searching for AI tools

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Exploited in the wild

The Brief

Researchers found 186 lookalike domains that pose as AI tools.
The domains serve ClickFix-style lures, browser-hijacking malware, and extensions that hijack user searches.
The Hacker News reported the findings on 2026-11-12.

Developers who search for AI tools can land on these fake domains and be served malware or browser-hijacking extensions.

Checklist · 1 of 10 yes

No	Hits tech teams	Judgment: fake AI-tool lookalike domains are a phishing campaign, not a developer platform breach.
No	Core infrastructure	Judgment: no core infrastructure software is flawed or compromised; only lookalike domains are used.
No	Popular tool	Judgment: AI tools are only impersonated by lookalike domains; the tools themselves are not flawed or compromised.
Yes	Exploited in the wild	The Hacker News: lookalike domains are being used to serve ClickFix lures and browser malware.
No	Public exploit	The Hacker News snippet does not say any exploit code or proof-of-concept is published.
No	Remote, no login	The Hacker News: lures need users to visit domains and act on ClickFix prompts, so user interaction is required.
No	Full takeover	The Hacker News mentions browser malware and search hijackers but does not report code execution or account takeover.
No	Secrets exposed	The Hacker News snippet does not report any stolen credentials, tokens, or user data.
No	Supply chain	The Hacker News: malicious lookalike domains and extensions; no legitimate project, package, or update is reported compromised.
No	No fix yet	The Hacker News snippet reports no vulnerability or vendor fix status; this is a campaign, not a flaw.

First seen 3h ago · 1 source · Full story page · How tiers are decided