Case ai-built-clickfix-smartratAI phishingWorldwide
AI-generated ClickFix sites on typosquatted domains deliver SmartRAT
In March 2026 Zscaler ThreatLabz saw typosquatting domains hosting malicious content made with AI website builders to run ClickFix lures delivering SmartRAT.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 15, 2026
- Location
- Worldwide
- Target
- Users visiting typosquatted domains
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
In March 2026 Zscaler ThreatLabz saw typosquatting domains hosting malicious content made with AI website builders to run ClickFix lures delivering SmartRAT.
Impact: Unknown; victim numbers are not stated.
Who triggered it
Actor: Unknown
Attribution: Not stated; described only as threat actors using AI website builders.
Motive: Malware delivery (SmartRAT).
How it happened
Attack vector: Typosquatted domains with convincing lures generated by AI-powered website creation tools, using ClickFix social engineering.
Root cause: AI website builders let attackers produce convincing lures quickly and at scale.
Timeline
- Reported by Zscaler ThreatLabz
Response
Zscaler ThreatLabz observed and published an analysis of the campaign.
Current status: Under investigation
Sources (open in a new tab)
- Zscaler ThreatLabz zscaler.com
Cite this case
AI-generated ClickFix sites on typosquatted domains deliver SmartRAT. AI Threat Watch, case ai-built-clickfix-smartrat, Mar 15, 2026. https://aithreat.io/cases/ai-built-clickfix-smartrat/
Permanent link: https://aithreat.io/cases/ai-built-clickfix-smartrat/