New TypoPrompting Attacks Turn Mistyped AI Website Addresses Into Malware Installation Traps

A simple typing mistake can now cost you more than a failed page load. Researchers have found that mistyped addresses of popular AI tools lead to fake verification pages, hidden commands and malware installers. The technique is called TypoPrompting.

The research traced 186 lookalike domains across 27 AI brands, including Claude, ChatGPT, DeepSeek, Perplexity, Midjourney, ElevenLabs and Cursor.

A small slip, such as “cloude.ai” for Claude, can send a visitor down a chain of redirects that ends in a ClickFix lure, a Microsoft Store-signed hijacker or a search-changing browser extension. This follows other reports of fake AI brand lures used to push harmful files and commands.

Analysts at Island identified the campaign and named the pattern TypoPrompting. They describe it as AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install or run something else. The research was published on November 12, 2026, by lead security researcher Oleg Zaytsev.

New TypoPrompting Attacks Turn Mistyped AI Website Addresses

The typos are ordinary. In “clsude.ai” the finger hits S instead of A. In “cluade.ai” two letters swap places. In “caude.ai” a letter goes missing. ChatGPT has the most lookalikes at 25, followed by Claude with 18 and DeepSeek with 16.

What happens next depends on the visitor. A parked page hands the browser to a traffic distribution system. That system picks a destination based on the visitor’s location, operating system and browser.

One person sees a harmless parked page, while another gets a malicious lure. Some of these names are years old. Several were registered in July 2023 and later joined a monetized portfolio of 81 domains tied to the redirector a11[.]click.

The Claude typo “cloude.ai” shows the full chain. A Windows visitor is sent through several redirect hops to a gate that fingerprints the browser and solves a small proof-of-work challenge. Only selected visits get an answer.

That answer is a fake human check, and fake Cloudflare verification pages have been seen in other ClickFix campaigns too. The page tells the user to open the Windows Run box, paste a command and press Enter.

The pasted command uses curl to save a script named W901.ps1 in the temporary folder. It then runs the script in a hidden PowerShell window with the execution policy bypassed.

The download address is written as the single number 3112851459. This is the IP address 185.138.88[.]3 in decimal form, so a filter looking for dotted IP addresses would miss it.

The gate behind this chain is much larger than one typo. Researchers found 550 matching scan records across 211 entry domains.

These include lookalikes of Scotiabank, Charles Schwab, Verizon and Microsoft Azure. Mac users get a fake Terminal prompt instead, and others are offered an archive to unpack and run.

Store-Signed Malware and Search Hijacking

A second route ends somewhere that looks far safer. Eight typos of Claude, DeepSeek, Copilot, ElevenLabs and Voice AI led through deezyj[.]com to fake “Security Check” pages.

These pages delivered Net Guard, an app sold as a Wi-Fi and DNS scanner. The installer matches the real Microsoft Store listing and carries Microsoft’s signature, so victims get a genuine Store package with a browser-control engine inside.

Net Guard is built on a module called buntai-sdk and takes its orders from remote configuration. It can change the default search engine while the user is idle.

It can also run remote JavaScript through browser DevTools and edit browser profiles to install extensions. In the code the researchers analyzed, all of these features are on by default.

The app also checks for a debugger and for enterprise browser management. Privacy Keeper and MyFlixly Browser share the same code and were also classed as malicious browser hijackers.

The third route starts at “preplexity.ai”, a Perplexity typo. It leads to an installation page for a Chrome extension that needs no permissions.

Its listing promises Bing search, but its manifest quietly sends every address-bar search through find.flashysearches[.]com. It is one of 30 extensions built from one kit.

Thirteen have been removed, and the 17 still listed showed 972,000 users on November 3. This matches the pattern in a recent report on Chrome extensions hijacking searches at a much larger scale.

Island advises organizations to give staff direct links to approved AI services and to watch for lookalikes of those tools.

It also suggests linking browsing activity to Run-dialog or Terminal use, checking the publisher and hash of MSIX installers, and setting a fixed search provider.

Security teams should hunt across the whole route, from entry domain to endpoint change. The same human-error risk appears when slopsquatting targets AI coding agents, where a wrong name leads to malware. Users can lower the risk by bookmarking the AI tools they use. A real verification page never asks you to paste a command.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs