Researchers at Island have tied 186 lookalike domains covering 27 AI brands to three separate payload routes: a ClickFix PowerShell lure dressed up as a Cloudflare check, a fake security-check page that installs a browser hijacker, and a family of Chrome extensions with 972,000 declared users that rewrites the default search engine.
What happened
Island calls the pattern TypoPrompting. The domains sit one or two characters away from real tool names - cloude[.]ai, chatlgpt[.]com, geimini[.]com, copiot[.]com, deepceek[.]com, preplexity[.]ai - and registration records show some were bought as far back as July 2023, so this was parked infrastructure waiting for AI tools to become everyday work.
The first route is ClickFix: a fake verification page that talks the visitor into pasting a PowerShell command into Windows, or a shell command on macOS. The second is eight typosquats that lead to security-check pages delivering Net Guard, an installer that matches the hash of a legitimate Wi-Fi and DNS scanner but can run attacker JavaScript, change the default search engine while the machine sits idle and install arbitrary Chrome extensions.
The third route needs no executable at all. A Perplexity lookalike pushes a Chrome Web Store extension called Quick Search, which overrides the default search provider to find.flashysearches[.]com without declaring a single permission. Island counted 16 live listings in that family with 972,000 users as of 3 November, including GPT for Chrome at 80,000. The tracking gate behind the campaign spans 211 entry domains and also covers lookalikes of banks, insurers and enterprise software.
Who is affected
Any organisation whose staff reach AI tools by typing a name into the address bar, and any fleet carrying extensions nobody approved.
- Windows and macOS endpoints where a user is free to paste a command from a web page - ClickFix works because the visitor does the work.
- Browsers with extensions installed outside policy, including Chrome profiles synced from personal accounts.
- Sites and tenants where the same browser holds mail and file access, because a hijacked search box sees everything typed into it.
- Anyone who has never checked which search provider their browsers actually use.
What to do now
Inventory browser extensions and the default search provider across every managed endpoint this week, and treat an unexpected search provider as an incident.
- Compare installed extensions against an approved list and remove the rest, starting with anything named Quick Search or GPT for Chrome.
- Check the default search engine per browser profile; a provider you do not recognise is a hijack, not a preference.
- Use Chrome Enterprise or Edge policy to pin the search provider and block user-installed extensions.
- Log or block lookups of obvious typo strings for AI brand names at the resolver.
- Tell staff plainly that no genuine verification page asks them to run a command.
What this means for South African businesses
AI tools moved from curiosity to daily work in most local SMEs inside a year, and almost none of them control how staff reach those tools - there is no proxy rule for the right address, so one wrong letter is the entire attack path. The search-hijack route is the quiet one: queries that carry internal hostnames, customer names and project details to a third party are a data leak no antivirus will flag. My read is that the paste-a-command lure will fail on most office staff, but a hijacked search provider spreads through a synced browser profile and can sit there for months - which is why extension inventory, not user training, is the control that pays here.
Source: The Hacker News, reporting Island's TypoPrompting research.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.