Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem

"AI-generated lookalike domains are now embedded inside the third-party scripts running on your web properties. Here's why your current stack can't see them, and what detection actually requires. Typosquatting is no longer a user problem. Attackers now embed lookalike domains inside legitimate third-party scripts. No mistyped URL required, no server breach needed."

"AI broke the economics of defense. LLMs generate thousands of convincing domain variants in minutes; full campaign deployment takes under ten. Malicious package uploads jumped 156% last year. Manual vetting is dead. Your security stack can't see this. Firewalls, WAFs, EDR, and CSP have no visibility into what approved scripts do once they execute in the browser."

"The Trust Wallet attack proved it. $8.5M stolen in 48 hours through a trojanized Chrome extension. No alert fired, not because something failed, but because nothing was watching. Not because they clicked a phishing link. Not because they reused a weak password. Not because they did anything wrong at all."

"A self-replicating npm worm called Shai-Hulud had spent months harvesting developer credentials: GitHub tokens, npm publishing keys, and Chrome Web Store API credentials. Those keys allowed attackers to push a trojanized version of the Trust Wallet Chrome extension through official channels. Chrome's verification passed it. The malicious extension executed entirely inside users' browsers, silently capturing seed phrases and transmitting them to the attacker's infrastructure at a domain disguised as Trust Wallet's own analytics endpoint. Within 48 hours, 2,500 wallets had been drained. Total loss: $8.5 million. No server was breached. No alert ever fired."

AI-generated lookalike domains are embedded inside third-party scripts that run on web properties. Typosquatting no longer depends on users mistyping URLs or attackers breaching servers. LLMs can generate thousands of convincing domain variants quickly, enabling full campaigns in under ten minutes, while malicious package uploads increased by 156% last year. Security controls such as firewalls, WAFs, EDR, and CSP lack visibility into what approved scripts do after they execute in the browser. A Trust Wallet incident showed a trojanized Chrome extension passed official verification and executed in users’ browsers, capturing seed phrases and sending them to attacker infrastructure disguised as a legitimate analytics endpoint. No alerts fired because nothing monitored the executed behavior.

Read at The Hacker News