GOOGLE CHROME · CMP-202611-volmsb · Other
NO FIX YET · SEE WHAT TO DO
Island found 186 lookalike domains for 27 AI brands (Claude, ChatGPT, Gemini, NotebookLM, Copilot, Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, Cursor). Someone who mistypes the address gets one of three things: a fake Cloudflare check that tells them to paste a PowerShell command on Windows or a shell command on macOS, or to download and run an archive (ClickFix); a fake 'Security Check' page that installs Net Guard, a browser hijacker that runs attacker JavaScript, changes the search engine and installs Chrome extensions; or the Quick Search Chrome extension, which sends every search to find.flashysearches[.]com. Quick Search is one of 16 such Chrome Web Store extensions, including 'GPT for Chrome', with 972,000 users in total (3 Nov 2026). The same fingerprinting script also sits on lookalike domains for Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow and Microsoft Azure (211 entry domains). Some domains were registered as early as 13 Jul 2023. Which organisations were hit is unknown.
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Quick Search or GPT for Chrome extensionNet Guard MSIX app installed on Windowsverify you are human or security update page that asks you to paste a command into Run, PowerShell or TerminalPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.