As reported by The Hacker News, researchers at Island have uncovered a sprawling campaign dubbed TypoPrompting — 186 lookalike domains impersonating 27 major AI brands, funneling victims through three distinct malware delivery pathways. This is not a sophisticated zero-day exploit. It is something arguably more dangerous: a well-engineered abuse of user trust, brand recognition, and the browser as an attack surface.

Threat Alert: As reported by The Hacker News, researchers at Island have uncovered a sprawling campaign dubbed TypoPrompting — 186 lookalike domains impersonating 27 major AI brands, funneling victims through three distinct malware delivery pathways.

Why This Campaign Is Different

TypoPrompting stands out because it weaponizes the explosive adoption of AI tools. Users are actively typing brand names like Claude, ChatGPT, Gemini, and Perplexity into browser address bars — often with typos. The campaign's domain portfolio (cloude[.]ai, chatlgpt[.]com, geimini[.]com, preplexity[.]ai) captures that fat-finger traffic with surgical precision.

But the real innovation is the multi-path delivery architecture. Three distinct payloads — ClickFix PowerShell lures, the Net Guard browser-hijacking malware, and a family of search-hijacking Chrome extensions — all flow from the same fingerprinting infrastructure. This modular design lets operators A/B test payloads, rotate monetization strategies, and adapt to takedowns without rebuilding their distribution network.

The 16 live Chrome Web Store extensions with 972,000 declared users represent the most alarming metric. That is not a fringe population — it is a sizeable installed base with active access to browsing sessions, search queries, and potentially corporate credentials.

Attack Chain Analysis

The fingerprinting gate is the campaign's backbone. It spans 211 entry domains — well beyond the 186 AI lookalikes — including typosquats of Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow, and Microsoft Azure. This tells us the operators are running a generalized typosquatting and parked-domain monetization operation, with AI brands simply being the most profitable vertical right now.

The chain proceeds: parked domain → browser fingerprinting + IP collection → TDS routing → payload selection. The ClickFix variant presents a fake Cloudflare verification page prompting users to run PowerShell — a well-known but still effective social engineering technique. Net Guard disguises itself as a 'Security Check' page. The extension pathway leverages Chrome Web Store legitimacy, which bypasses many native browser security warnings entirely.

Who Is at Risk

Attack Chain Analysis
Knowledge workers who type AI tool URLs directly rather than using bookmarks or official apps
Enterprise environments where browser extensions are not centrally managed or blocklisted
Financial services and healthcare organizations — the 211-domain fingerprinting gate targets their brands too
Any organization whose users have installed one of the 16 malicious Chrome extensions — search query hijacking can expose internal search patterns and redirect to phishing infrastructure

Shield53 Recommendations

Immediate Actions

  • Audit Chrome extensions enterprise-wide. Pull the installed extensions list from all managed browsers. Cross-reference against any extension claiming to provide 'search security,' 'Net Guard,' or AI tool integration. Force-remove anything not on an approved allowlist.
  • Block known malicious domains at DNS resolvers and web proxies. The article lists 12 indicator domains — feed these into your SIEM, proxy blocklists, and endpoint DNS filtering rules immediately.
  • Deploy DNS filtering for typosquatted AI brands. Proactively block common typo variants of Claude, ChatGPT, Gemini, Copilot, Grok, DeepSeek, Mistral, Perplexity, and Midjourney domains. Consider using a typosquat detection service or programmatically generating candidate patterns.
  • Restrict PowerShell execution via Constrained Language Mode or AppLocker/WDAC policies. ClickFix lures lose their payload delivery mechanism if users cannot execute arbitrary PowerShell from a copied command.
  • Enable Chrome extension blocklisting via Group Policy. Set ExtensionInstallBlocklist to * and use ExtensionInstallAllowlist for approved extensions only.

Strategic Actions

  • Distribute official AI tool bookmarks via MDM or GPO. If employees are typing URLs manually, they will eventually typo. Push bookmarks for sanctioned AI tools to eliminate the typosquatting attack surface entirely.
  • Monitor DNS logs for access to any of the 211 fingerprinting gate domains. Hits indicate either a typo or a user navigating to a spoofed brand — both warrant follow-up.
  • Train help desk staff to recognize ClickFix-style social engineering. The fake Cloudflare verification page is now a standard adversary technique. Users calling about 'verification prompts' should trigger a security review, not a password reset.
  • Track browser extension telemetry. If your EDR or browser management platform does not report installed extensions, close that visibility gap. Extensions are a persistent blind spot in many environments.

The TypoPrompting campaign illustrates a broader pattern: as AI tools become default workplace infrastructure, their brand equity becomes attack infrastructure. Defenders should treat AI tool domain names with the same protective posture already applied to banking and SaaS authentication domains — because adversaries clearly are.