“AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install or run something else,” Island warned — a concise description of a campaign that now uses 186 bogus domains to reroute users toward lures, browser malware, and search‑hijacking extensions.
TypoPrompting, according to Island
Island, a cybersecurity company, has codenamed the delivery pattern TypoPrompting. The firm’s analysis — shared with The Hacker News — shows attackers registered or deployed 186 lookalike domains impersonating 27 AI brands, including Anthropic Claude, OpenAI ChatGPT, Google Gemini and Gemini Notebook, Microsoft Copilot, SpaceXAI Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, and Cursor.
Some examples of the typosquat and lookalike domains Island identified include cloude[.]ai, cluade[.]ai, clsude[.]ai, chatlgpt[.]com, geimini[.]com, notebookklm[.]com, griok[.]com, preplexity[.]ai, deepceek[.]com, elevenlebs[.]io, copiot[.]com, and midj0urney[.]org. Registration records show domains such as cloude[.]ai and cluade[.]ai were registered as early as July 13, 2023.
The ClickFix route and the fingerprint gate
One of three principal attack routes begins on parked or lookalike pages that initiate a redirect chain. That chain fingerprints the visitor’s browser and collects the public IP address before displaying a fake Cloudflare verification page. In the ClickFix variant the parked page ultimately serves a PowerShell command via a counterfeit verification flow.
Island says the fingerprinting gate spans a broader set of 211 entry domains — not limited to AI tools — and includes lookalikes of banks, insurers, and enterprise software such as Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow, and Microsoft Azure. The campaign’s lures fall into three concrete behaviors: fake verification pages on Windows designed to run a clipboard command; terminal or security update prompts on macOS designed to run a shell command; and archive download pages instructing users to extract and run an executable.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageNet Guard delivered through fake “Security Check” pages
Eight typosquat domains for Claude, DeepSeek, Copilot, ElevenLabs, and Voice AI lead to fake “Security Check” pages that ultimately install a browser‑hijacking package Island calls Net Guard. Though the app purports to be a Wi‑Fi and DNS safety scanner and matches the MSIX hash for a legitimate app with the same name, Island reports it contains malicious capabilities.
Net Guard can run attacker‑controlled JavaScript, change the default search engine while the user is idle, edit browser profiles, and install arbitrary Chrome extensions — behaviors that exceed the stated purpose of a safety scanner and enable broad manipulation of a user’s browsing environment.
Perplexity lookalike redirects to a 16‑extension family with 972,000 users
A third pathway revolves around a Perplexity lookalike domain, preplexity[.]ai, which redirects to a Chrome extension called Quick Search in the Chrome Web Store. Island found Quick Search needs no executable JavaScript or declared permissions to perform its main action: its manifest overrides the default search provider with find.flashysearches[.]com, and searches routed through that provider are sent to a third party.
Quick Search is part of a family of 16 extensions available in the Chrome Web Store. Island counted 16 live listings and a combined 972,000 declared users as of November 3, 2026; one named example, GPT for Chrome, had 80,000 users. Island warns that queries sent through such overrides “in a workplace” can include internal hostnames, customer names, and project details.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Monitor for manifest changes and unexpected search‑provider overrides; Island highlights that an analyzed extension can override search without declared permissions and that Net Guard can install extensions and edit browser profiles.
- Procurement and IT procurement leaders: Consider the report’s observation that “reaching the right one should be a managed path, not a test of typing accuracy” — managed access to sanctioned tools can reduce reliance on free‑form URLs that attackers mimic.
- End users and knowledge workers: Be aware that an address one letter away from an AI tool can lead to a different request; the campaign uses fake verification prompts, terminal commands, and archive downloads to induce risky actions.
Island’s findings also echo an earlier mechanism described by Infoblox in December 2025: parked domains can be monetized and funneled through traffic distribution systems, enabling redirects to scams and malware. As Infoblox put it, “When a domain owner opts into direct search, traffic to the domain is sold to advertisers who bid on keywords and traffic characteristics,” a legitimate model that can be weaponized for abuse.
Island’s succinct takeaway frames the danger plainly: “An address one letter away from an AI tool can lead to a very different request.” For organizations and users that rely on AI services daily, the work Island documents suggests the risk is not only malicious new code but also the familiar, persistent trick of typos and redirected traffic — a gap where convenience and attention intersect with exploitation.
Original reporting: The Hacker News — 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
