Island researchers have linked lookalike AI-service domains to fake verification prompts, browser-hijacking software and search-redirecting extensions. Their November 12 TypoPrompting report inventories 186 domains imitating 27 AI brands.
The inventory includes parked domains alongside harmful delivery routes. Destinations can vary by location, operating system and browser, so Island did not establish that every address delivered malware to every visitor.
One Claude lookalike reached a fake Cloudflare check that prompted visitors to run a Windows command. Another route, traced from eight AI typos, delivered Net Guard through fake security checks. Island classified the analyzed application as a malicious browser hijacker capable of changing search settings and running remotely supplied scripts.
The researchers said the downloaded Net Guard package matched its Microsoft Store version and carried a Store signature. A third route pushed a search-hijacking extension.
For defenders, the findings support using managed bookmarks for approved AI tools, controlling extension installation and monitoring suspicious browser-to-shell activity.
