A Typo in an AI Site's Name Can Lead to Malware, Island Finds

What happened

Island published the report on Nov 12, naming the delivery pattern TypoPrompting: a user aiming for Claude, ChatGPT, Gemini or another AI tool lands on someone else's domain after one mistyped letter. The study covers 186 lookalike domains across 27 brands, with ChatGPT drawing the most, 25, followed by Claude with 18 and DeepSeek with 16; some domains were registered as early as July 2023.

The first route is ClickFix: taking cloude.ai as an example, the visitor reaches a parked page, is routed by a traffic distribution system based on country, operating system and browser, and ends on a fake Cloudflare verification page that instructs them to open the Run dialog, paste a command and press Enter — the command uses curl to download a PowerShell script from an IP address written as a single decimal number and run it. macOS visitors see a fake Terminal or security update pushing a curl pipeline instead, and other visitors are offered an archive with instructions to extract and run the executable inside.

The second route runs through fake security-check pages serving Net Guard, a Wi-Fi and DNS safety scanner listed in the Microsoft Store: the file hash matches the Store listing and it carries Microsoft's Marketplace signature — but Island's analysis found browser-hijacking code inside that can change the default search engine while the user is idle, run remotely supplied scripts through DevTools, edit browser profiles and install extensions. The third route leads to search-hijacking extensions: of 30 extensions built from the same kit, 13 have been removed from the Chrome Web Store and 17 remain listed, showing 972,000 users between them on Nov 3.

Key facts

1. Scale: 186 lookalike domains across 27 AI brands; ChatGPT 25, Claude 18, DeepSeek 16; some domains registered in July 2023
2. Route one: ClickFix: cloude.ai leads to a fake Cloudflare verification page that prompts the visitor to paste and run a PowerShell command, fetched from a decimal-encoded IP address
3. Route two: Fake security-check pages serve Net Guard, a Microsoft Store-signed app containing browser-hijacking code that can change search settings, run remote scripts and install extensions
4. Route three: 30 search-hijacking extensions from one kit; 13 removed, 17 still listed, with 972,000 users between them as of Nov 3
5. Delivery: Parked pages route visitors through a traffic distribution system by country, OS and browser; the wider gate spans 211 entry domains, also impersonating banks, insurers and enterprise software
6. Also: chatlgpt.com served Installer_ChatGPT.zip in October and November, and the file was flagged as malicious