TypoPrompting: One Wrong Key on an AI Tool's Address Leads to ClickFix, a Store-Signed Browser Hijacker or a Search Hijacker. Island's Indicators Are in Our Feed
Block the TypoPrompting indicators Island published today, put a DNS filter on newly registered lookalikes of the AI tools your organization actually uses, and tell your staff one plain rule: no AI website will ever ask you to paste a command into the Windows Run box or a Mac Terminal. If one does, close the tab. The domains, the payload IP and the three package hashes from Island's appendix are now in our feed, so subscribers to domains.csv, ips.csv and hashes.csv pick them up on the next pull.
Island, the enterprise browser company, published "TypoPrompting: From AI Typos to Malware" on Thursday, November 12, 2026, written by its lead security researcher Oleg Zaytsev. The finding is simple to state. People mistype the names of AI tools like everyone mistypes everything, and someone has registered the mistakes. Island counted 186 lookalike domains across 27 AI brands, from Claude and ChatGPT to DeepSeek, Perplexity, Midjourney, ElevenLabs and Cursor. Some of those typos are just parked. Others lead somewhere worse.
What is confirmed
Island traced three delivery routes from the typos. These figures are Island's, measured on its own crawl with a data snapshot dated November 3, 2026.
Route one: ClickFix. The Claude typo cloude[.]ai led through a traffic-distribution chain to a fake Cloudflare verification page. That page copies a command to the clipboard and walks the visitor through opening the Windows Run dialog, pasting and pressing Enter. Island recovered the command. It uses curl.exe to save a file named W901.ps1 to the temp folder and then runs it in PowerShell with a hidden window and an execution-policy bypass. The download host is written as the single decimal number 3112851459, which is 185.138.88[.]3, so, in Island's words, "the URL contains no dotted IP address for a pattern-based filter to catch." The gate script behind that lure serves 211 entry domains, and its hash matched 550 scan records between April 2025 and November 2026. Mac visitors get a fake Terminal or security update instead.
Route two: Net Guard, a Microsoft Store-signed browser hijacker. Eight AI typos, including Claude, DeepSeek, Copilot, ElevenLabs and Voice AI lookalikes, led to fake "Security Check" pages that delivered Net Guard, an app sold as a Wi-Fi and DNS safety scanner. Zaytsev told The Hacker News the download "is the Microsoft Store app itself, unmodified." Island's analysis says the app can change the default search engine while the user is idle, run remotely supplied scripts through Chrome DevTools, and edit browser profiles and extensions. Island analyzed two sibling packages, Privacy Keeper and MyFlixly Browser, found they share the same code, and classifies all three as malicious browser hijackers. The AI typos are a slice of a bigger funnel: 191 lander domains, about 45 product names and 1,437 source domains, including lookalikes of banks, insurers and telecoms.
Route three: search hijacking. The Perplexity typo preplexity[.]ai led to a Chrome extension whose manifest replaces your default search provider with find.flashysearches[.]com, which sends your queries to a third party. Island found 30 extensions built from the same kit. Thirteen have been removed from the Chrome Web Store; the 17 still listed showed 972,000 users combined on November 3. Island's own figure caption counts 16 live listings, so treat the listing count as 16 or 17. Socket documented the same technique in its Searchjacked research on October 29 and lists 22 of the 30.
Island's closing point is the one that matters in an office: "In a workplace, those queries can include internal hostnames, customer names and project details."
What is not known
Island did not publish the full list of 186 domains. Its appendix is labelled "selected indicators," and its figure of one lookalike per brand says the set spans "parked domains and malicious delivery routes." So the 186 is Island's inventory, not a blocklist, and we have not added domains Island only named in passing.
The payload behind W901.ps1 is not described in the report, so we cannot tell you what it installs. Two appendix domains are old: midj0urney[.]org, whose Windows payload Island says AlienVault OTX attributed to the Aurora stealer in 2023, and deepsek[.]icu, an Android payload Island says K7 Labs attributed to OctoV2 in early 2025. Nobody has named an operator behind TypoPrompting, and Island does not say the three routes are run by one actor. The cloude[.]ai, cluade[.]ai and caude[.]ai registrations date to July 13, 2023, so some of this real estate has been sitting there for more than three years.
What to do
- Block the list. Island's appendix, now in our feed as source manual-batch-typoprompting, at confidence 80. Our domains.csv does not filter on confidence, so every domain ships to default subscribers. The payload IP is at 80, above the default ips.csv floor of 50, so it ships by default too.
- DNS-filter newly registered lookalikes of the AI tools your company has approved. A short list (claude.ai, chatgpt.com, gemini.google.com, copilot.microsoft.com, perplexity.ai, cursor.com, whatever you use) and a newly-registered-domains category in your resolver cover most of this. Island's own first recommendation is the cheapest one: "Provide a direct route to approved AI services." Push managed bookmarks so nobody types the address.
- Teach the one rule. No AI tool, no CAPTCHA and no "security check" asks you to open Run, Terminal or PowerShell and paste something. That is ClickFix, every time.
- Hunt the handoff. Island suggests correlating recent browsing with Run-dialog or Terminal activity, "especially hidden PowerShell, execution-policy bypass flags and decimal IP addresses." A curl.exe that writes a .ps1 to %TEMP% and a powershell -w h -ep bypass right after it is the pattern.
- Do not trust a Store signature to describe behavior. Island: "a Store signature alone does not describe browser behavior." Search endpoints for the Net Guard package family MyflixlyApp.NetGuard_k6q889pad57pt and the Store IDs 9MX3CH3BQ44Q, 9N1B4VPCS2S2 and 9PG42QDLFW8T.
- Manage search and extensions centrally. Set the approved search provider by policy and check for the extension IDs lihnhjjcdlfdomjliljlommppbfacmbj and nlmpdomhofmjdidcghodlgneobojdjfm. Island's note: review search overrides "even when an extension requests no permissions."
This is the consumer side of a problem we have written about from the brand side, in "AI Hallucinates a Domain for Your Brand. An Attacker Registers It Before You Do." The typo and the hallucination land on the same kind of registration: https://www.dugganusa.com/post/ai-hallucinates-a-domain-for-your-brand-an-attacker-registers-it-before-you-do-we-already-measure
How we know
We read Island's report directly and took the indicators from its appendix, not from press copies. The Hacker News article by Ravie Lakshmanan was our lead and traces to the same single source.
The appendix lists 34 domains, one IP address and three SHA-256 package hashes. Before ingesting, we checked each domain and the IP against our own corpus with our correlate lookup. Thirty-three of the 35 were not held. Two were, and neither is our detection: chatlgpt[.]com entered our index on October 27 and 185.138.88[.]3 on November 5, both through the third-party TweetFeed relay of posts by MalwareHunterTeam, at confidence 70 with no actor or family. That is corroboration from an independent researcher before Island published, credited to MalwareHunterTeam, not a lead of ours. None of the 35 had neighbors in our indicator graph. None of the three hashes was held.
We ingested all 38 network and file indicators from the appendix (34 domains, 1 IP, 3 hashes) under source manual-batch-typoprompting, with references to Island and The Hacker News. Each record was read back from our index by its primary key: 38 of 38 confirmed, one of them after a short queue delay. We then downloaded our own published feed files and checked them: all 34 domains are in domains.csv, the IP is in ips.csv and all three hashes are in hashes.csv.
Our edge cannot see this attack. It happens when someone in your organization visits a lookalike site, not when someone probes ours. We did check whether the payload host 185.138.88[.]3 had touched our edge since August 1: zero hits across 394,794 edge blocks, 125,561 edge-canary records and 5,594 origin honeypot captures. That is a measurement of our own sites, and it says nothing about yours.
We left out of the feed the lookalikes Island names only in the body of the report (chatgpy[.]com, opnai[.]com, anthropiv[.]com and others), because Island's own figure says its set mixes parked and malicious names, and the report does not say which those are. We also left out the legitimate brand domains, the decimal form of the IP, the W901.ps1 filename, the Store IDs and the extension IDs, which are not network indicators. They are listed above for your endpoint and browser tooling.
Sources
Island, "TypoPrompting: From AI Typos to Malware," Oleg Zaytsev, November 12, 2026: https://www.island.io/blog/typoprompting-from-ai-typos-to-malware
The Hacker News, "186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers," Ravie Lakshmanan, November 12, 2026: https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html
Net Guard on the Microsoft Store (the listing Island analyzed): https://apps.microsoft.com/detail/9mx3ch3bq44q
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.