Overview
Cybersecurity researchers at Island have identified a large-scale typosquatting campaign, codenamed TypoPrompting, exploiting user trust in popular AI platforms. Across 186 bogus domains impersonating 27 AI brands—including Anthropic Claude, OpenAI ChatGPT, Google Gemini, Microsoft Copilot, DeepSeek, Mistral, Perplexity, Midjourney, and ElevenLabs—threat actors are funnelling victims into three distinct malware delivery pathways. The campaign is notable for its scale, brand diversity, and use of AI tool familiarity as a social engineering lever.
Technical Analysis
The campaign operates via three delivery routes:
ClickFix Lure (PowerShell): Parked domain pages fingerprint the visitor’s browser and collect their public IP address before presenting a fake Cloudflare verification page. On Windows, this page delivers a clipboard-injected PowerShell command. On macOS, a fake terminal or security update prompt delivers a shell command. Archive-based variants instruct users to extract and run an executable.
Net Guard Browser Hijacker: Eight typosquat domains targeting Claude, DeepSeek, Copilot, ElevenLabs, and Voice AI redirect users to fake “Security Check” pages that install a browser-hijacking malware family called Net Guard.
Search Hijacking Extensions: A third pathway leads to a family of rogue Chrome extensions with 16 live Chrome Web Store listings and approximately 972,000 declared users—indicating significant real-world reach before detection.
Representative lookalike domains include cloude[.]ai, cluade[.]ai, chatlgpt[.]com, geimini[.]com, notebookklm[.]com, and deepceek[.]com. Some domains were registered as early as July 2023, suggesting long-term infrastructure staging. A broader fingerprint gate network of 211 entry domains also impersonates banks, insurers, and enterprise software vendors.
The traffic distribution follows a pattern consistent with direct search monetisation—domain owners sell visitor traffic to advertisers, and third-party traffic distribution systems (TDSs) route users to malicious payloads based on device and browser profiling.
Framework Mapping
- AML.T0047 (AI-Enabled Product or Service): Attackers abuse the brand recognition of legitimate AI services to manipulate user behaviour.
- AML.T0114 (AI Service Web Interface): Fake web interfaces mimicking AI tools are the primary deception surface.
- AML.T0113 (Steal Web Session Cookie): Browser-hijacking malware like Net Guard is consistent with session and credential harvesting objectives.
- LLM09 (Overreliance): Users over-trusting familiar AI brand interfaces are the core victim profile.
- LLM05 (Supply Chain Vulnerabilities): Rogue Chrome extensions distributed via the official Web Store represent a supply chain injection vector.
Impact Assessment
With nearly one million declared users on the rogue Chrome extensions alone, the campaign has achieved meaningful scale. ClickFix infections may result in remote access trojan (RAT) deployment or credential theft. Browser hijackers persistently redirect search traffic, enabling advertising fraud and data collection. The cross-platform delivery (Windows PowerShell, macOS shell) broadens the victim pool.
Mitigation & Recommendations
- Block at DNS layer: Deploy the 186 identified lookalike domains as blocklist entries in enterprise DNS resolvers and web proxies.
- Audit Chrome extensions: Cross-reference installed extensions against the 16 flagged Web Store listings identified in the report.
- User awareness: Train staff to recognise ClickFix-style fake Cloudflare verification prompts and to validate AI tool URLs before interacting.
- Endpoint monitoring: Alert on unexpected PowerShell clipboard execution and unsolicited shell command prompts on macOS.
- Domain monitoring: Subscribe to typosquat monitoring services for critical AI tool brands used by your organisation.