Skip to content
Malware Campaign Exploits AI Domain Typos to Hijack Browsers

Malware Campaign Exploits AI Domain Typos to Hijack Browsers

First seen 12 Nov 2026, 15:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 13, 2026 at 14:42 UTC
  • •186 lookalike domains across 27 AI brands are being exploited.
  • •Malware delivery methods include ClickFix lures and browser-hijacking extensions.
  • •The campaign has affected approximately 972,000 users of malicious Chrome extensions.

A cybersecurity campaign has identified 186 lookalike domains targeting 27 AI brands, including ChatGPT and Claude, using a method called TypoPrompting. These typos redirect users to malicious sites delivering ClickFix lures, browser-hijacking malware, and harmful extensions. The malware includes a PowerShell command executed from a fake Cloudflare verification page and a Microsoft Store-signed app called Net Guard that alters browser settings. The campaign has been active since at least July 2023, with significant user impact, including 972,000 users of malicious extensions. The technique leverages common typing errors to exploit unsuspecting users, with a high likelihood of success due to the familiarity of the targeted brands. Researchers have traced the delivery method through a complex network of parked domains and traffic distribution systems. The scope of the attack is extensive, affecting various sectors, including finance and technology.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2023-07-13
Registration of malicious domains began
Some of the lookalike domains were registered as early as July 13, 2023, to exploit user typos.
Thehackernews
2025-12-01
Infoblox report on parked domains
Infoblox documented the use of parked domains for malware delivery, noting a 90% scam rate for visitors.
Gbhackers
2026-11-12
TypoPrompting campaign reported
Cybersecurity researchers disclosed the TypoPrompting campaign, detailing its methods and impact.
Thehackernews
2026-11-13
Public disclosure of malware details
Island researchers published findings on the malware's operation and its effects on users.
www.island.io

More articles in this cluster (6)

Following this threat?

Track Aurora Stealer and Blue Cross Blue Shield in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (29)

1 / 3

Common questions

What AI brands are affected?
The campaign targets 27 AI brands, including ChatGPT, Claude, and DeepSeek.
How can I identify these malicious domains?
Look for misspellings or variations of known AI tool domains, such as cloude[.]ai or cluade[.]ai.
What should I do if I visited these sites?
Run a malware scan on your device and monitor for any unusual browser behavior.