Cybersecurity experts have uncovered a network of fraudulent domains that mimic well-known artificial intelligence (AI) services to deploy malware and hijack users’ searches. This deceptive practice, identified as TypoPrompting by researchers at Island, involves redirecting users to malicious software and search hijackers.
TypoPrompting: A New Cyber Threat
TypoPrompting is a method where users attempting to access legitimate AI tools are misled into downloading or verifying something else. According to Island’s report, these fake domains are impersonating 27 AI brands, including popular names like Anthropic Claude, OpenAI ChatGPT, and Google Gemini.
The campaign encompasses 186 counterfeit domains. Some lead to ClickFix-style traps that use phony Cloudflare pages to deliver PowerShell commands. Others direct users to ‘Security Check’ pages that install the Net Guard malware, which hijacks browsers. Additionally, a set of browser extensions alter search results.
Exploiting Parked Domains
The use of parked domains for malicious activities is not unprecedented. Infoblox highlighted how such domains can monetize traffic by redirecting visitors to scam sites. This process involves profiling visitors’ devices and employing third-party advertising systems to exploit a legitimate business model.
The ClickFix route employs a redirect sequence that identifies users’ browsers and IP addresses, then presents a fake verification page. This tactic is part of a broader scheme involving 211 similar domains, impersonating various sectors, including banking and enterprise software.
Malicious Extensions and Search Hijacking
Some impostor domains prompt users to download browser extensions that hijack search settings. For instance, the ‘preplexity[.]ai’ domain redirects to an extension known as Quick Search, which alters the default search engine to one that collects data for third-party use.
This extension is among 16 others, including GPT for Chrome, collectively used by 972,000 users as of November 3, 2026. These extensions compromise user privacy by redirecting search queries to third parties, potentially exposing sensitive workplace information.
Overall, these deceptive practices underscore the need for vigilance in navigating online tools. As the usage of AI services grows, ensuring secure access is critical to prevent falling victim to these sophisticated scams.
