TypoPrompting: 186 Fake AI-Brand Typosquat Domains Deliver ClickFix Lures, Net Guard Browser Hijacker, and Quick Search Extension

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5888 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TypoPrompting ClickFix curl.exe to PowerShell W901.ps1 Execution — Exploitation (Splunk SPL)

Detects the TypoPrompting ClickFix chain executed after a victim pastes the lure command into the Run dialog: curl.exe (silent, --ssl-no-revoke, retries) saves a .ps1 payload (W901.ps1 in %TEMP%, path /985) from 185.138.88.3 (also written as decimal 3112851459) and hidden, no-profile, execution-policy-bypass PowerShell runs it. The KQL flavor also covers the macOS Terminal curl-piped-to-zsh lure from raw-IP URLs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001, T1105, T1059.004
• Data sources: sysmon (XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), DeviceProcessEvents (Microsoft Defender for Endpoint), windows process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    ( (Image="*\\curl.exe" (CommandLine="*185.138.88.3*" OR CommandLine="*3112851459*" OR (CommandLine="*.ps1*" CommandLine="*--ssl-no-revoke*" (CommandLine="*\\Temp\\*" OR CommandLine="*%TEMP%*"))))
      OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") CommandLine="*W901.ps1*")
      OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") CommandLine="*Bypass*" CommandLine="*Hidden*" CommandLine="*\\Temp\\*.ps1*" (ParentImage="*\\explorer.exe" OR ParentImage="*\\cmd.exe" OR ParentImage="*\\curl.exe")) )
| eval ioc_hit=case(match(CommandLine,"185\\.138\\.88\\.3|3112851459"),"clickfix_payload_host",match(CommandLine,"W901\\.ps1"),"w901_payload",true(),"curl_ps1_hidden_bypass_behaviour")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentImage) as parents values(ioc_hit) as ioc_hit by host User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let PayloadIndicators = dynamic(["185.138.88.3", "3112851459", "W901.ps1"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where
    (FileName =~ "curl.exe" and (ProcessCommandLine has_any (PayloadIndicators)
        or ProcessCommandLine matches regex @"(?i)https?://\d{8,10}(/|\s|$)"
        or (ProcessCommandLine has ".ps1" and ProcessCommandLine has "--ssl-no-revoke" and ProcessCommandLine has_any ("%TEMP%", @"\Temp\"))))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and (ProcessCommandLine has "W901.ps1"
        or (ProcessCommandLine has "Bypass" and ProcessCommandLine has_any ("Hidden", "-w hidden") and ProcessCommandLine matches regex @"(?i)\\Temp\\\S*\.ps1")))
    or (ProcessCommandLine matches regex @"(?i)curl\s.*https?://\d{1,3}(\.\d{1,3}){3}[^|]*\|\s*(zsh|bash|sh)\b")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: TypoPrompting ClickFix curl.exe Download of PowerShell Payload (W901.ps1)
id: c0a15888-0001-4a11-8b01-5e8800000101
status: experimental
description: Detects the TypoPrompting ClickFix command pasted into the Run dialog - curl.exe saving a .ps1 payload to the temp folder (W901.ps1 from 185.138.88.3 or 3112851459) followed by hidden, execution-policy-bypass PowerShell.
references:
    - https://www.island.io/blog/typoprompting-from-ai-typos-to-malware
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_curl:
        Image|endswith: '\curl.exe'
        CommandLine|contains|all:
            - '.ps1'
            - '--ssl-no-revoke'
    selection_ioc:
        CommandLine|contains:
            - '185.138.88.3'
            - '3112851459'
            - 'W901.ps1'
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Bypass'
            - 'Hidden'
            - '.ps1'
    selection_temp:
        CommandLine|contains:
            - '\Temp\'
            - '%TEMP%'
    condition: selection_curl or selection_ioc or (selection_ps and selection_temp)
falsepositives:
    - Administrators or software deployment scripts that use curl.exe to stage PowerShell scripts in a temp folder
level: high

Known false positives:

• Administrators or deployment tooling using curl.exe to stage PowerShell scripts in %TEMP% with execution-policy bypass
• Legitimate macOS developer installers that pipe curl output from a raw-IP URL into a shell

Tuning notes: Treat the payload host and W901.ps1 matches as high-fidelity alerts and keep the behavioural branch at medium. Exclude known software-deployment parent processes and service accounts. PowerShell may be launched with abbreviated switches (-ep, -w hidden); extend the Bypass/Hidden terms if needed. Restrict the macOS branch to Terminal parents if noisy.

• 🔒 TypoPrompting ClickFix curl.exe to PowerShell W901.ps1 Execution — Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 TypoPrompting Net Guard and Quick Search Browser Hijack Persistence — Post-Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 TypoPrompting Typosquat, ClickFix Gate and Hijacker Infrastructure Contact — C2 Infrastructure (Sentinel KQL) · unlock with TL Creds
• 🔒 TypoPrompting ClickFix curl.exe to PowerShell W901.ps1 Execution — Exploitation (Sigma) · unlock with TL Creds
• 🔒 TypoPrompting Net Guard and Quick Search Browser Hijack Persistence — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 TypoPrompting Typosquat, ClickFix Gate and Hijacker Infrastructure Contact — C2 Infrastructure (Sigma) · unlock with TL Creds
• 🔒 TypoPrompting Net Guard and Quick Search Browser Hijack Persistence — Post-Exploitation (Splunk SPL) · unlock with TL Creds
• 🔒 TypoPrompting Typosquat, ClickFix Gate and Hijacker Infrastructure Contact — C2 Infrastructure (Splunk SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 35 indicators of compromise for TL-2026-5888.

Sample indicators (3 of 35)

• IP address: 185.138.88[.]3
• Domain: cloude[.]ai
• File hash: bdddb50204d6867b4bd73d9cfe93cbc98c4518342da104e4608f04e675ac6cb3

Defanged, TLP:CLEAR. Full set of 35 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

The extension family had 972,000 declared users as of 2026-11-03; no threat actor is named.

TypoPrompting is a monetized typosquatting campaign named by Island. Lookalike domains for 27 AI brands (ChatGPT 25 domains, Claude 18, DeepSeek 16, Runway 12, Perplexity/Lovable/Character.ai 11 each) use adjacent-key, swapped, dropped, added-letter and phonetic typos. Earliest registrations in the set date to 2023-07-13 (Claude and Perplexity lookalikes). Visitors land on parked pages that feed a traffic distribution system and are split into three routes.

Route 1 - ClickFix. The typo domain forwards via xml.securetrackingnode[.]com/click to biomimicrydevtech[.]buzz (URL parameters carry campaign/publisher IDs, subid=<typo domain>, country, OS and browser; Windows flow_id=81) and then to a random subdomain of blockchainfuturedev[.]buzz, a fingerprint gate. The gate collects a FingerprintJS profile, solves an MD5 proof-of-work, looks up the public IP, posts the profile, and only selected visits receive a lure. The response is obfuscated (Base64, XOR with a per-visit token, string reversal, eval). Island pivoted on the gate script hash to 550 scan records across 211 entry domains (April 2025 to November 2026), including domains impersonating banks, insurers and enterprise software. The lure is a fake Cloudflare-style verification page in six languages whose clipboard handler places a command for the victim to paste into the Run dialog. The recovered command uses curl.exe (silent, fail, follow-redirects, --ssl-no-revoke, 8 retries, 20s connect timeout) to save a payload to %TEMP%\W901.ps1 from 185.138.88.3 (written in decimal form 3112851459), path /985, then runs it with hidden-window, no-profile, execution-policy-bypass PowerShell. macOS visitors receive fake Terminal/security-update lures using a curl piped to zsh, and other lures present archives to extract and run. chatlgpt[.]com served Installer_ChatGPT.zip in Oct-Nov 2026 (9 of 16 MetaDefender engines flag the executable).

Route 2 - Net Guard. Typos (e.g. ckaude[.]ai, deepceek[.]com, copiot[.]com, elevenlebs[.]io, vocie[.]ai) redirect via deezyj[.]com to a fake 'Security Check' page that delivers Net Guard from netguardsite[.]com (May 2026) and netguardprotect[.]com (August 2026). The MSIX is byte-identical to the Microsoft Store package (publisher 'Myflixly App', Store ID 9MX3CH3BQ44Q, package family MyflixlyApp.NetGuard_k6q889pad57pt, v1.0.9.0) and carries the Store signature. Island's code analysis found default-enabled capabilities: changing the default search engine while the user is idle via UI Automation and synthetic input (Chrome, with a Firefox equivalent), running remote JavaScript through DevTools Runtime.evaluate, editing Chrome profile files, installing extensions via PowerShell and the registry, enabling browser sync after a 30-second welcome countdown, startup with full trust, and checks for a debugger and enterprise browser management. It is built on Tauri with a 'buntai-sdk' module driven by remote configuration; related packages Privacy Keeper and MyFlixly Browser share the code. Scope: 191 related lander domains, about 45 product names, 1,437 source domains.

Route 3 - Quick Search. preplexity[.]ai leads via a related-search page to quickflashtool[.]com, an install page for an unlisted Chrome Web Store extension with no executable JavaScript and no declared permissions whose manifest overrides the default search provider with find.flashysearches[.]com while the listing claims Bing. 30 extensions share the template under separate developer accounts; 13 were removed; the remaining listings declare 972,000 users as of 2026-11-03 (source text says 17 listed, a figure caption says 16). Socket's 'Searchjacked' research (2026-10-29) flagged 22 of the 30.

Monetization appears to be the driver: Adsterra smartlinks (three shared keys, March-October 2026) and Monica/Pollo affiliate referrals, tied together by the a11[.]click portfolio redirector (registered 2026-03-06). Island links infrastructure through shared publisher keys, affiliate IDs, a shared gate script hash and shared extension kit templates; it does not name an actor. Third parties attribute older payloads on some lookalikes: midj0urney[.]org (2023) to Aurora stealer via Invalid Printer loader (AlienVault OTX) and deepsek[.]icu (early 2025) to OctoV2 Android malware (K7 Labs). BeaconBeagle lookups for 185.138.88.3 and flashysearches.com returned HTTP 502 and could not be checked.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1622 Debugger Evasion

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1105 Ingress Tool Transfer

Persistence

T1176 Software Extensions; T1547 Boot or Logon Autostart Execution

Initial Access

T1189 Drive-by Compromise; T1566.002 Phishing: Spearphishing Link

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1608.001 Stage Capabilities: Upload Malware

Reconnaissance

T1592 Gather Victim Host Information

Remediation

Immediate actions

• Block the listed typosquat, redirector, gate, installer and search-hijack domains and 185.138.88.3 at DNS and web proxy
• Search endpoints for %TEMP%\W901.ps1, Net Guard (MyflixlyApp.NetGuard_k6q889pad57pt), Privacy Keeper and MyFlixly Browser packages and remove them
• Audit Chrome for extensions overriding the default search provider to find.flashysearches.com, including IDs lihnhjjcdlfdomjliljlommppbfacmbj and nlmpdomhofmjdidcghodlgneobojdjfm, and remove them
• Hunt for curl.exe downloading a .ps1 into %TEMP% followed by powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass, and for decimal-encoded IP URLs
• Reset browser search settings and review profiles of users who visited AI-brand typosquats

Workarounds

• Disable the Windows Run dialog via policy where feasible
• Use enterprise browser management so Net Guard's managed-browser checks and profile edits are constrained

Longer-term hardening

• Restrict Chrome extension installation to an allowlist and lock the default search provider via enterprise policy
• Restrict Microsoft Store/MSIX app installation on managed endpoints
• Train users that legitimate verification pages never require pasting commands into the Run dialog or Terminal
• Monitor newly registered and parked lookalike domains of AI brands used by the organization

Affected and fixed versions

• Google — Chrome (default search provider and extensions)
  Vulnerable versions: Browser profiles affected by Net Guard or Quick Search extensions
• Microsoft — Windows (ClickFix PowerShell lure, Net Guard MSIX)
  Vulnerable versions: Windows endpoints where users run pasted commands or install the app
• Apple — macOS (Terminal curl-to-zsh ClickFix lure)
  Vulnerable versions: macOS endpoints where users run pasted commands

Timeline

Last updated 2026-11-13 · revalidated 1× · latest source

• 2023-07-13 Earliest recorded registration in the set: Claude and Perplexity lookalike domains such as locked-ioc-25 and locked-ioc-26
• 2025-04-01 Earliest scan records matching the fingerprint-gate kit script across the 211 entry domains (April 2025 to November 2026)
• 2026-03-06 locked-ioc-30 portfolio redirector domain registered
• 2026-03-11 First shared Adsterra smartlink key observed in the redirect infrastructure (keys seen March-October 2026)
• 2026-03-27 Kling AI lookalike domains (kiling.ai, klig.ai, klign.ai) registered
• 2026-05-01 Net Guard installer pages appear on locked-ioc-11
• 2026-08-01 locked-ioc-9 installer records begin
• 2026-10-01 locked-ioc-18 begins serving locked-ioc-8 fake desktop download (active October-November 2026)
• 2026-10-29 Socket publishes 'Searchjacked' research flagging 22 of the 30 kit extensions as malicious
• 2026-11-03 Island snapshot: remaining Quick Search family listings declare 972,000 users (13 of 30 extensions already removed)
• 2026-11-12 Island publishes TypoPrompting research; The Hacker News reports the campaign
• 2026-11-13 GBHackers reports the TypoPrompting campaign, citing Island's research.

Update history

• 2026-11-13 — TypoPrompting: Typosquatted AI Brand Domains (ChatGPT, Claude, DeepSeek) Deliver ClickFix Malware and Browser Hijackers: What changed No change to severity (HIGH), exploitability (ACTIVE), status (ACTIVE) or attribution. Additive enrichment only. New indicators (2) Indicator values are withheld at this access level.

Sources cited

• TypoPrompting: From AI Typos to Malware (Island) island.io · Research · 2026-11-12
• How Attackers Use Sponsored Search and Custom GPTs in Malware Delivery (Island) island.io · Research
• 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers The Hacker News · News · 2026-11-12
• Typosquatting Is No Longer a User Problem (The Hacker News) The Hacker News · News
• Malicious Chrome extension captures AI query keystrokes (Cybernews) cybernews.com · News
• Security researchers discover fake ChatGPT ads that trick you into downloading malware (Tom's Guide) tomsguide.com · News

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• ArcticRAT: AI-Powered Android RAT Evolved from Targeted Crypto-Stealer Previous report
• Fake Zillow Apartment-Review Pages Use ClickFix to Deploy NetSupport RAT Next report