Security researchers have uncovered a large-scale campaign involving 186 phony domains that mimic popular AI tools. These domains, targeting 27 major brands like ChatGPT, Claude, Gemini, Copilot, Midjourney, Perplexity and others, redirect users toward malware, browser hijackers, or scam-like verification prompts. The operation, dubbed “TypoPrompting,” employs lookalikes of AI tools to trick people into installing malicious extensions or running harmful commands. The findings were shared in a report by a cyber defense firm.
Three Paths to Hijacking
The fake domains follow three main tactics. First, visitors may be lured via a fake “verification” page — styled like Cloudflare — after their browser is fingerprinted and IP collected. That stage then leads to a prompt to run PowerShell on Windows, a shell command on macOS or download an executable disguised behind an archive extraction. Second, certain typosquats lead to “Security Check” pages which push a malware called Net Guard. Net Guard is masked as Wi-Fi or DNS protection but has the ability to execute attacker-controlled JavaScript, change default search engines, edit browser profiles, and install unwanted Chrome extensions. Third, a pick of lookalikes directs users to typical search-hijacking extensions in the Chrome Web Store, notably “Quick Search,” which takes over the browser’s default search provider and reroutes query data to third parties.
How Bad Is It?
The scale is significant. The 186 domains mimic 27 AI platforms including OpenAI’s ChatGPT, Google’s Gemini, Anthropic Claude, DeepSeek, Midjourney, ElevenLabs, and others. Within this network, 16 malicious extensions—some already hosted on the Chrome Web Store—amass 972,000 total users as of November 3, 2026. One highlighted copycat domain, “preplexity.ai,” funnels visitors to a search hijack extension. Another, “cloude.ai,” dates back to July 13, 2023. Many domains were registered years ago and left “parked” — blank sites used later to redirect users.
Island, the firm leading the investigation, also notes that its research covers 211 entry-point domains beyond the AI lookalikes. These include fakes of banks, insurers, telecoms, and enterprise software brands such as Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow, and Microsoft Azure. Traffic is eventually converted into redirects that lead visitors through traffic distribution systems (TDS), a complex ad-tech web used for monetizing URLs and delivering threats.
Why TypoPrompting Works
This campaign exploits human error—typos when typing familiar AI service names. An address off by one letter can send someone not to ChatGPT but to clickbait, malware, or even worse. Parked domains and domain registrations allow attackers to capture traffic at scale. They mask malicious behavior under legitimate branding and turn trust into opportunity for harm. Plus, the extensions involved require minimal declared permissions yet can hijack search queries, inject scripts, or disturb browser configurations.
Key takeaways:
- 186 fake domains, 27 AI brands targeted.
- Malicious behavior includes executing system commands, installing malware, hijacking searches, altering browser profiles.
- Nearly a million users impacted via browser extensions.
- Lookalike domains may be years old but activated or weaponized recently.
Your decisions when navigating to one of these domains could mean the difference between being redirected to an AI tool or falling into a trap. Always double-check URLs, avoid installing software prompted via a website, and use trusted bookmarks or official links.
As AI becomes more ingrained in work and personal life, confusion over domains grows risk. TypoPrompting underscores how apparently small errors — a missing or swapped character in a URL — can lead to serious consequences. Watch for surface similarities, use password managers or URL suggestion tools, and rely on official app stores and documentation for access. Vigilance is your first line of defense.
