Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches.

This delivery pattern has been codenamed TypoPrompting by Island.

"AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install or run something else," the cybersecurity company said in a report shared with The Hacker News.

In all, the campaign spans 186 bogus domains spanning 27 AI brands, including Anthropic Claude, OpenAI ChatGPT, Google Gemini and Gemini Notebook (formerly NotebookLM), Microsoft Copilot, SpaceXAI Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, and Cursor.

While one category leads to a ClickFix lure that serves a PowerShell command via a fake Cloudflare verification page, the second route takes unsuspecting users to "Security Check" pages that deliver a browser-hijacking malware called Net Guard. The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users.

Some of the AI lookalike domains are listed below -

• cloude[.]ai
• cluade[.]ai
• clsude[.]ai
• chatlgpt[.]com
• geimini[.]com
• notebookklm[.]com
• griok[.]com
• preplexity[.]ai
• deepceek[.]com
• elevenlebs[.]io
• copiot[.]com
• midj0urney[.]org

An analysis of registration records shows that some of these domains, like cloude[.]ai and cluade[.]ai, were registered as early as July 13, 2023.

The use of parked domains for malware delivery is not new. In December 2025, Infoblox highlighted how domains without a current web page can be monetized to redirect visitors to sites that serve scams and malware after profiling the host and the device they are visiting from.

"When a domain owner opts into direct search, traffic to the domain is sold to advertisers who bid on keywords and traffic characteristics," the DNS threat intelligence firm noted at the time. "In practice, the site visitor is usually funneled through a series of traffic distribution systems (TDSs) operated by third-party advertising platforms, creating a complex web where a legitimate business model is weaponized for abuse."

In the case of the ClickFix route, the parked page initiates a redirect chain that fingerprints the web browser and collects the public IP address before displaying the fake Cloudflare verification page.

Island said the fingerprint gate script spans a broader set of 211 entry domains, including lookalikes of banks, insurers, and enterprise software, such as Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow, and Microsoft Azure.

These domains serve three types of lures -

• Fake verification pages on Windows that are designed to run a clipboard command
• Terminal or security updates on macOS that are designed to run a shell command
• Archive download pages that instruct users to extract and run an executable

Separately, eight typosquat domains for Claude, DeepSeek, Copilot, ElevenLabs, and Voice AI lead to fake "Security Check" pages that ultimately deliver Net Guard.

While the app purports to be a Wi-Fi and DNS safety scanner and matches the MSIX hash for a legitimate app of the same name, it contains capabilities to run attacker-controlled JavaScript, change the default search engine while the user is idle, edit browser profiles, and install arbitrary Chrome extensions.

"The download from the 'Security Check' pages is the Microsoft Store app itself, unmodified," Oleg Zaytsev, Lead Security Researcher at Island, told The Hacker News. "It is byte-for-byte identical to Net Guard as Microsoft distributes it, and it carries Microsoft’s own Store signature."

"The hidden browser control comes with every copy, whether installed from the Store or from a typo site, and it switches itself on without asking. It waits until the user stops using the computer, then takes over Chrome's search settings and can run scripts inside the browser, following instructions from the operator's server."

The third route revolves around a lookalike domain for Perplexity ("preplexity[.]ai"), which redirects the browser to a browser extension called Quick Search that's available on the Chrome Web Store.

"The analyzed extension needs no executable JavaScript or declared permissions to perform its main action," Island said. "Its manifest overrides the default search provider with find.flashysearches[.]com . Searches made through that provider are sent to a third party. In a workplace, those queries can include internal hostnames, customer names and project details."

Quick Search is part of a larger set of 16 extensions, including GPT for Chrome, which has 80,000 users. In all, the extensions collectively have 972,000 users as of November 3, 2026.

"An address one letter away from an AI tool can lead to a very different request," Island said. "As these services become part of everyday work, reaching the right one should be a managed path, not a test of typing accuracy."

(The story was updated after publication to include a response from Island.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.