You type the name of an AI tool. You miss one letter. You land on a page that asks you to verify you are human, or to install a security check, or to run a command.

Island has a name for this pattern: TypoPrompting. The company describes it as AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install, or run something else.

The campaign spans 186 bogus domains across 27 AI brands. The list includes Anthropic Claude, OpenAI ChatGPT, Google Gemini, Microsoft Copilot, Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, and Cursor.

The Three Routes

Each route leads somewhere different, and the third one does not need you to install anything at all.

The Domains

Island published a sample of the lookalikes.

• cloude[.]ai
• cluade[.]ai
• clsude[.]ai
• chatlgpt[.]com
• geimini[.]com
• notebookklm[.]com
• griok[.]com
• preplexity[.]ai
• deepceek[.]com
• elevenlebs[.]io
• copiot[.]com
• midj0urney[.]org

Registration records show some of these, including cloude[.]ai and cluade[.]ai, were registered as early as July 13, 2023.

That is two years of sitting on a typo. It is not an opportunistic grab. It is an investment.

Route One: The ClickFix Chain

The parked page starts a redirect chain. That chain fingerprints the browser and collects the public IP address. Only then does it show the fake Cloudflare verification page.

Island says the fingerprint gate script spans a broader set of 211 entry domains, and that set is not limited to AI tools. It includes lookalikes for banks, insurers, and enterprise software, including Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow, and Microsoft Azure.

The lures come in three flavors.

• Windows: A fake verification page designed to get the user to run a clipboard command.
• macOS: A fake terminal or security update prompt designed to run a shell command.
• Archive downloads: Pages that instruct the user to extract and run an executable.

The clipboard trick is the part that makes ClickFix work. The user copies a "verification code," pastes it into a terminal or the Run dialog, and the pasted text is the payload. The browser never has to exploit anything.

Route Two: Net Guard

Eight typosquat domains for Claude, DeepSeek, Copilot, ElevenLabs, and Voice AI lead to fake "Security Check" pages. Those pages deliver Net Guard.

Net Guard presents itself as a Wi-Fi and DNS safety scanner. And here is the detail that makes this campaign unusual. The download is the legitimate Microsoft Store app, unmodified.

Oleg Zaytsev, Lead Security Researcher at Island, explained it directly. The download from the Security Check pages is the Microsoft Store app itself, byte-for-byte identical to what Microsoft distributes, carrying Microsoft's own Store signature. The MSIX hash matches.

That signature is why the download looks trustworthy, and it is genuinely trustworthy. The problem is what the app does.

Zaytsev's description is worth quoting in full. The hidden browser control comes with every copy, whether installed from the Store or from a typo site, and it switches itself on without asking. It waits until the user stops using the computer, then takes over Chrome's search settings and can run scripts inside the browser, following instructions from the operator's server.

What the app can do, per Island:

• Run attacker-controlled JavaScript
• Change the default search engine while the user is idle
• Edit browser profiles
• Install arbitrary Chrome extensions

The signed-app angle matters for detection. A security tool that blocks unsigned binaries has nothing to say about this. The binary is signed by Microsoft.

Route Three: Quick Search

The third route does not require a download at all.

A lookalike domain for Perplexity, preplexity[.]ai, redirects the browser to a Chrome Web Store listing for an extension called Quick Search.

Island's finding on this one is the most interesting of the three. The analyzed extension needs no executable JavaScript and declares no permissions to perform its main action. Its manifest overrides the default search provider with find.flashysearches[.]com.

Every search made through that provider goes to a third party.

In a workplace, those queries can include internal hostnames, customer names, and project details. Search bars are where people type the things they are trying to figure out, and that is exactly the data being harvested.

Quick Search belongs to a set of 16 extensions, including GPT for Chrome, which has 80,000 users. The group collectively claims 972,000 users as of November 3, 2026.

Why Parked Domains Keep Working

Using parked domains for malware delivery is not new.

In December 2025, Infoblox explained the economics. When a domain owner opts into direct search, traffic to that domain gets sold to advertisers who bid on keywords and traffic characteristics. The visitor is funneled through a series of traffic distribution systems operated by third-party ad platforms.

That creates a legitimate business model that is trivially weaponized. The domain does not need an owner running a scam. It just needs a traffic broker willing to sell clicks to whoever bids.

What Defenders Should Do

• Block the lookalike domains at DNS. The list above is a starting point, not a complete set. The full campaign spans 186 domains.
• Hunt for find.flashysearches[.]com in your proxy and DNS logs. That is the search provider the Quick Search extension uses. It is a specific, searchable indicator.
• Inventory Chrome extensions across your fleet. Especially anything with search-related or browser-profile access. The 16-extension family has 972,000 declared users, which means some of them are on managed machines.
• Do not rely on code signing alone. Net Guard carries Microsoft's Store signature and is byte-identical to the legitimate app. Signature checks will pass.
• Treat clipboard-to-terminal instructions as hostile. No legitimate verification flow asks a user to paste a command into PowerShell or Terminal. Train staff on that specific pattern.
• Provide a managed path to AI tools. Island's closing point is the right one. An address one letter away from an AI tool can lead to a very different request, and reaching the right one should be a managed path, not a test of typing accuracy.
• Monitor for browser setting changes. Default search engine changes, new profile edits, and silently installed extensions are all detectable through browser management tooling.
• Watch the idle window. Net Guard waits until the user stops using the computer before acting. Endpoint telemetry that correlates idle state with browser configuration changes is worth building.

The Design Lesson

Every one of these routes avoids the thing defenders are best at catching.

Route one uses the clipboard, so no exploit fires in the browser. Route two uses a signed binary, so signature checks pass. Route three uses a manifest override with no permissions, so extension permission reviews see nothing.

None of it requires a zero-day. All of it requires a user to land on the wrong domain.

FAQ

What is TypoPrompting?

Island's term for AI-app lookalike domains that turn an attempt to reach a familiar tool into a prompt to verify, install, or run something else.

How many domains are involved?

186 bogus domains across 27 AI brands, according to Island.

What happens on the ClickFix route?

The parked page runs a redirect chain that fingerprints the browser and collects the public IP address, then shows a fake Cloudflare verification page that leads the user to run a clipboard command.

Is Net Guard malware?

It is a legitimate Microsoft Store app with a legitimate signature. The problem is that it contains hidden browser control that activates on its own, takes over Chrome search settings, and can run scripts on instructions from an operator server.

Why does the signed app matter?

Because security tools that block unsigned binaries will not flag it. The download is byte-for-byte identical to the app Microsoft distributes, and the MSIX hash matches.

What is Quick Search?

A Chrome extension that overrides the default search provider with find.flashysearches[.]com. It needs no executable JavaScript and declares no permissions to do it.

Why is the search hijack a workplace problem?

Because search queries from work machines include internal hostnames, customer names, and project details. All of that goes to a third party.

How many users do these extensions have?

The 16-extension family collectively claims 972,000 users as of November 3, 2026. GPT for Chrome alone claims 80,000.

How do I block this?

Block the known lookalike domains at DNS, hunt for find.flashysearches[.]com in logs, inventory Chrome extensions, and give staff a managed path to AI tools rather than relying on accurate typing.

Source: The Hacker News