Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

TypoPrompting: 186 AI lookalikes route users to malware

3 sources · 3 articlesFirst reported Updated ()1
What's new

November 13: Cyber Security News names Privacy Keeper and MyFlixly Browser with Net Guard as hijackers and says Island published the research on November 12.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Island says 186 lookalike domains for 27 AI brands send mistyped visitors to ClickFix lures, Net Guard, or search hijackers.

Island and researcher Oleg Zaytsev describe TypoPrompting: 186 lookalike domains for 27 AI brands route mistyped visitors through a traffic-distribution system to ClickFix lures, crypto scams, signed hijackers, or search-hijacking Chrome extensions. ChatGPT had 25 lookalikes, Claude 18, and DeepSeek 16, GBHackers reports. One path fingerprints the browser, then shows a fake Cloudflare page or, on macOS, a fake Terminal update; Windows stages can fetch W901.ps1 from 185.138.88.3. The Hacker News says 16 extensions had 972,000 declared users on November 3, 2026, while GBHackers and Cyber Security News count 17 still-listed extensions from one kit at that total. Eight typosquats deliver Net Guard, which can run attacker JavaScript, change search, and install extensions.

Key facts
  • Lookalikes cover Claude, ChatGPT, Gemini, Copilot, Grok, DeepSeek, and others.
  • A gate serves 211 entry domains, including bank and insurer lookalikes.
  • Net Guard, Privacy Keeper, and MyFlixly Browser were classed as hijackers.
  • Quick Search overrides search with find.flashysearches.com and needs no declared permissions.
  • Some domains, including cloude.ai, were registered as early as July 13, 2023.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 13, 2023Some lookalike domains, including cloude.ai, were registered. · The Hacker News
  2. Nov 3, 2026Related search-hijack extensions showed 972,000 users. · The Hacker News
  3. Nov 12, 2026Island published its TypoPrompting research. · Cyber Security News

What each outlet adds

beyond the shared facts
  • The Hacker NewsEight typosquats deliver Net Guard; Quick Search needs no permissions.
  • GBHackersBrand counts, W901.ps1 address, and macOS fake Terminal lure.
  • Cyber Security NewsNames Privacy Keeper and MyFlixly Browser as hijackers.
Vendors
MicrosoftGoogle
Products
ChatGPTClaudeDeepSeekChrome Web Store
Malware
Net GuardPrivacy KeeperMyFlixly BrowserQuick SearchAuroraW901.ps1
Organizations
IslandAnthropicOpenAIMicrosoftInfoblox
AI models
ClaudeChatGPTGeminiCopilotGrokDeepSeekPerplexity

Coverage

oldest first · one row per article · UTC
  1. · 1d ago The Hacker NewsFirst report

    186 fake AI domains serve ClickFix lures and browser malware

    Island says the TypoPrompting paths also include Net Guard and 16 search-hijack extensions declaring 972,000 users.

  2. · 1d ago GBHackers

    AI brand typosquats deliver ClickFix malware and browser hijackers

    Island traced 186 lookalike domains across 27 AI brands, with some chains pasting PowerShell that downloads a script.

  3. · 22h ago Cyber Security News

    TypoPrompting turns mistyped AI site addresses into malware lures

    Island traced 186 lookalike domains across 27 AI brands to ClickFix commands, signed hijackers, and search extensions.