Cybersecurity researchers have exposed a rising class of threats dubbed “TypoPrompting,” in which users who miskey the URLs of well-known AI services are routed through malicious domains that masquerade as verification pages or push dangerous software. The attack chain targets people who attempt to reach tools like Claude, ChatGPT, Midjourney, ElevenLabs, DeepSeek, Copilot and others. On November 12, 2026, analysts from security firm Island published findings revealing nearly 200 lookalike domains tied to at least 27 AI brands.
How TypoPrompting Works
A simple typo—swapping letters, omitting one, hitting the wrong key—can send a user into a maze of redirects. Those misdirected through domains like “cloude.ai” (instead of “claude.ai”) or “clsude.ai” may first land on parked pages that lead onward based on their device, browser or region. Some visitors encounter benign content; others see counterfeit verification (including fake Cloudflare pages) demanding system commands.
This approach often ends with misleading prompts to run PowerShell scripts, view fake human checks, or execute installer files—all while the URL appears harmless. Attackers even avoid detection by expressing malicious addresses in decimal form instead of using dotted IPs.
From Browser Hijacking to Installer Traps
Several distinct paths have been uncovered. One route leads to a fake “Security Check” page where visitors are coaxed into installing a Microsoft Store–signed application called Net Guard, which carries browser-control components and hijacks default search engines. Apps like Privacy Keeper and MyFlixly Browser share the same module and turn on features by default—such as the ability to run remote scripts through DevTools.
Another misleading flow begins at a typo of Perplexity, delivering a Chrome extension that appears innocuous but reroutes search queries through shady domains like find.flashysearches.com. That kit has been used to deploy some 30 extensions; 17 remain live as of early November, with nearly a million users potentially exposed.
Scope and Indicators of Compromise
The investigation pinpointed 186 lookalike domains across AI brands, with ChatGPT alone having 25 such typos, Claude about 18, and DeepSeek roughly 16. Nearly every major AI service examined had at least one copycat domain designed to mislead. Some domains go back two years—with registrations dating to mid-2023—and form part of a larger monetized portfolio built around the redirector “a11.click.”
Researchers provided a list of IoCs: misspellings like cloude.ai, clsude.ai, caude.ai, cluade.ai and others targeting Claude; similarly off-brand domains targeting DeepSeek, Copilot, Voice AI and Perplexity. Also included are Microsoft Store package identifiers (e.g. Net Guard version 1.0.9.0), SHA-256 hashes, and domains using decimal-form IPs.
What Organizations and Users Can Do
To defend against TypoPrompting, firms are urged to give employees direct, vetted links to trusted AI tools, avoid clicking mistyped domains, and lock down search provider settings. Security teams should inspect incoming domain names, verify software publishers and hashes for any Microsoft Store installers, and monitor entire redirect pathways—from the first mis-typed domain to final downloads or changes in browser settings. Bookmarking official services, avoiding prompts to paste commands or disclose credentials on verification pages, and scrutinizing app behavior for network or search engine changes are simple but effective steps.
These abuses represent an evolution of name-based deception in cybersecurity—what began as typosquatting is now weaponized using redirection, fake installers, credential lures, and malicious extensions. As AI adoption and reliance grows, attackers are investing in more sophisticated, brand-aware traps.
What this means: The rise of TypoPrompting highlights how attackers are piggybacking on brand trust and typographical errors to deliver targeted harm. Organizations should now treat every URL carefully—mistyped or not—as a potential attack vector. Watch closely for domains that look familiar but aren’t exact matches, refuse unsolicited “verification” commands, and ensure perimeter defenses cover both domains and downstream software. Without these countermeasures, even “small” typos could open wide doors for malware.
