AI brand typosquats deliver ClickFix malware and browser hijackers
Original title: Hackers Exploit ChatGPT and Claude Website Typos to Deliver Malware and Hijack Browsers
Island traced 186 lookalike domains across 27 AI brands, with some chains pasting PowerShell that downloads a script.
Oleg Zaytsev and Island documented a pattern they call TypoPrompting: mistyped AI sites pass visitors through a traffic-distribution system to ClickFix lures, crypto scams, or search-hijacking extensions. ChatGPT had the most lookalikes, with 25, followed by Claude with 18 and DeepSeek with 16. One Claude typo chain fingerprints the browser, then copies a curl command that runs W901.ps1 in hidden PowerShell. Signed MSIX packages, including Net Guard, can change the default search engine.
Unconfirmed: Campaign scope and payload behavior are as reported by Island and Zaytsev; older examples are separate historical cases.
- A single gate serves 211 entry domains, with 550 scan records from April 2025 to November 2026.
- The PowerShell stage downloads W901.ps1 from decimal address 3112851459, or 185.138.88.3.
- Seventeen still-listed extensions from one kit showed 972,000 users on November 3.
- macOS visitors are shown a fake Terminal update that pipes curl output into zsh.
- Infoblox previously found parked-domain visitors sent to scams or malware about 90 percent of the time.
Impact: Malware install or browser search and extension hijacking
- 1.Use managed bookmarks for approved AI tools and watch for lookalike domains.
- 2.Correlate browsing with Run-dialog use and flag hidden PowerShell, bypass flags, and decimal IPs.
- 3.Judge MSIX files by package family, publisher, and hash, not a Store signature alone.
- ATT&CK
- T1583.001 Acquire Infrastructure: DomainsT1059.001 PowerShellT1176 Browser ExtensionsT1204.002 User Execution: Malicious File
- AI models
- ChatGPTClaudeDeepSeekPerplexity
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | biomimicrydevtech.buzz | de[.]ai typo redirects through securetrackingnode[.]com and biomimicrydevtech[.]buzz. It then reaches blockchainfuturedev[.]buzz, which finger |
| domain | blockchainfuturedev.buzz | ingnode[.]com and biomimicrydevtech[.]buzz. It then reaches blockchainfuturedev[.]buzz, which fingerprints the browser and makes it solve an MD5 |
| domain | caude.ai | ai, swapped letters in cluade[.]ai, and a dropped letter in caude[.]ai. A parked page passes the visitor to a traffic distributi |
| domain | chatlgpt.com | os deliver payloads directly. In October and November 2026, chatlgpt[.]com offered Installer_ChatGPT.zip, which 9 of 16 MetaDefender |
| domain | cloude.ai | time, and that cloaking shows scanners a harmless page. The cloude[.]ai typo redirects through securetrackingnode[.]com and biomi |
| domain | clsude.ai | Seek with 16. The slips are mundane: an adjacent-key hit in clsude[.]ai, swapped letters in cluade[.]ai, and a dropped letter in |
| domain | cluade.ai | ane: an adjacent-key hit in clsude[.]ai, swapped letters in cluade[.]ai, and a dropped letter in caude[.]ai. A parked page passes |
| domain | deepsek.icu | stealer through the Invalid Printer loader. In early 2025, deepsek[.]icu served an Android package. Island recommends managed book |
| domain | deezyj.com | ude, DeepSeek, Copilot, ElevenLabs and Voice AI led through deezyj[.]com to fake “Security Check” pages. These pages delivered Net |
| domain | flashysearches.com | lashtool[.]com and a Chrome extension access that sets find.flashysearches[.]com as the search provider. The extension requests no permiss |
| domain | midj0urney.org | T.zip, which 9 of 16 MetaDefender engines flagged. In 2023, midj0urney[.]org served Aurora stealer through the Invalid Printer loader. |
| domain | preplexity.ai | all three packages as browser hijackers. A Perplexity typo, preplexity[.]ai, led to quickflashtool[.]com and a Chrome extension acces |
| domain | quickflashtool.com | owser hijackers. A Perplexity typo, preplexity[.]ai, led to quickflashtool[.]com and a Chrome extension access that sets find.flashysearch |
| domain | securetrackingnode.com | ers a harmless page. The cloude[.]ai typo redirects through securetrackingnode[.]com and biomimicrydevtech[.]buzz. It then reaches blockchainf |
| ipv4 | 185.138.88.3 | ses curl.exe to download W901.ps1 from 3112851459, which is 185.138.88[.]3 written as a decimal number. It then runs the script in a |
From the original article
3 min read at gbhackers.com
Oleg Zaytsev traced 186 lookalike domains across 27 AI brands, including Claude, ChatGPT, DeepSeek, Perplexity, Midjourney, ElevenLabs and Cursor. He named the delivery pattern TypoPrompting. Ordinary typing errors led visitors to ClickFix lures, browser-hijacking malware and search-hijacking extensions.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.