# TypoPrompting: 186 Fake AI-Brand Typosquat Domains Deliver ClickFix Lures, Net Guard Browser Hijacker, and Quick Search Extension

> Island's TypoPrompting research documents 186 typosquat domains impersonating 27 AI brands (Claude, ChatGPT, Gemini, Copilot, DeepSeek, Perplexity and others) that fingerprint visitors and route them to ClickFix clipboard lures, a Store-signed browser hijacker (Net Guard), or a search-provider-overriding Chrome extension (Quick Search). The extension family had 972,000 declared users as of 2026-11-03; no threat actor is named.

- **Published:** 2026-11-12T20:19:49Z
- **Last reviewed:** 2026-11-13T19:54:34.167Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5888
- **ID:** TL-2026-5888
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 35 (3 shown free below)

## Description

TypoPrompting is a monetized typosquatting campaign named by Island. Lookalike domains for 27 AI brands (ChatGPT 25 domains, Claude 18, DeepSeek 16, Runway 12, Perplexity/Lovable/Character.ai 11 each) use adjacent-key, swapped, dropped, added-letter and phonetic typos. Earliest registrations in the set date to 2023-07-13 (Claude and Perplexity lookalikes). Visitors land on parked pages that feed a traffic distribution system and are split into three routes.

Route 1 - ClickFix. The typo domain forwards via xml.securetrackingnode[.]com/click to biomimicrydevtech[.]buzz (URL parameters carry campaign/publisher IDs, subid=<typo domain>, country, OS and browser; Windows flow_id=81) and then to a random subdomain of blockchainfuturedev[.]buzz, a fingerprint gate. The gate collects a FingerprintJS profile, solves an MD5 proof-of-work, looks up the public IP, posts the profile, and only selected visits receive a lure. The response is obfuscated (Base64, XOR with a per-visit token, string reversal, eval). Island pivoted on the gate script hash to 550 scan records across 211 entry domains (April 2025 to November 2026), including domains impersonating banks, insurers and enterprise software. The lure is a fake Cloudflare-style verification page in six languages whose clipboard handler places a command for the victim to paste into the Run dialog. The recovered command uses curl.exe (silent, fail, follow-redirects, --ssl-no-revoke, 8 retries, 20s connect timeout) to save a payload to %TEMP%\W901.ps1 from 185.138.88.3 (written in decimal form 3112851459), path /985, then runs it with hidden-window, no-profile, execution-policy-bypass PowerShell. macOS visitors receive fake Terminal/security-update lures using a curl piped to zsh, and other lures present archives to extract and run. chatlgpt[.]com served Installer_ChatGPT.zip in Oct-Nov 2026 (9 of 16 MetaDefender engines flag the executable).

Route 2 - Net Guard. Typos (e.g. ckaude[.]ai, deepceek[.]com, copiot[.]com, elevenlebs[.]io, vocie[.]ai) redirect via deezyj[.]com to a fake 'Security Check' page that delivers Net Guard from netguardsite[.]com (May 2026) and netguardprotect[.]com (August 2026). The MSIX is byte-identical to the Microsoft Store package (publisher 'Myflixly App', Store ID 9MX3CH3BQ44Q, package family MyflixlyApp.NetGuard_k6q889pad57pt, v1.0.9.0) and carries the Store signature. Island's code analysis found default-enabled capabilities: changing the default search engine while the user is idle via UI Automation and synthetic input (Chrome, with a Firefox equivalent), running remote JavaScript through DevTools Runtime.evaluate, editing Chrome profile files, installing extensions via PowerShell and the registry, enabling browser sync after a 30-second welcome countdown, startup with full trust, and checks for a debugger and enterprise browser management. It is built on Tauri with a 'buntai-sdk' module driven by remote configuration; related packages Privacy Keeper and MyFlixly Browser share the code. Scope: 191 related lander domains, about 45 product names, 1,437 source domains.

Route 3 - Quick Search. preplexity[.]ai leads via a related-search page to quickflashtool[.]com, an install page for an unlisted Chrome Web Store extension with no executable JavaScript and no declared permissions whose manifest overrides the default search provider with find.flashysearches[.]com while the listing claims Bing. 30 extensions share the template under separate developer accounts; 13 were removed; the remaining listings declare 972,000 users as of 2026-11-03 (source text says 17 listed, a figure caption says 16). Socket's 'Searchjacked' research (2026-10-29) flagged 22 of the 30.

Monetization appears to be the driver: Adsterra smartlinks (three shared keys, March-October 2026) and Monica/Pollo affiliate referrals, tied together by the a11[.]click portfolio redirector (registered 2026-03-06). Island links infrastructure through shared publisher keys, affiliate IDs, a shared gate script hash and shared extension kit templates; it does not name an actor. Third parties attribute older payloads on some lookalikes: midj0urney[.]org (2023) to Aurora stealer via Invalid Printer loader (AlienVault OTX) and deepsek[.]icu (early 2025) to OctoV2 Android malware (K7 Labs). BeaconBeagle lookups for 185.138.88.3 and flashysearches.com returned HTTP 502 and could not be checked.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1592 Gather Victim Host Information
- T1566.002 Phishing: Spearphishing Link
- T1204.004 User Execution: Malicious Copy and Paste
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1622 Debugger Evasion
- T1608.001 Stage Capabilities: Upload Malware
- T1189 Drive-by Compromise
- T1547 Boot or Logon Autostart Execution
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TypoPrompting ClickFix curl.exe to PowerShell W901.ps1 Execution — Exploitation (Splunk SPL)** (`TL-2026-5888-SPL-001`)

Detects the TypoPrompting ClickFix chain executed after a victim pastes the lure command into the Run dialog: curl.exe (silent, --ssl-no-revoke, retries) saves a .ps1 payload (W901.ps1 in %TEMP%, path /985) from 185.138.88.3 (also written as decimal 3112851459) and hidden, no-profile, execution-policy-bypass PowerShell runs it. The KQL flavor also covers the macOS Terminal curl-piped-to-zsh lure from raw-IP URLs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1105, T1059.004
- **Data sources:** sysmon (XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), DeviceProcessEvents (Microsoft Defender for Endpoint), windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    ( (Image="*\\curl.exe" (CommandLine="*185.138.88.3*" OR CommandLine="*3112851459*" OR (CommandLine="*.ps1*" CommandLine="*--ssl-no-revoke*" (CommandLine="*\\Temp\\*" OR CommandLine="*%TEMP%*"))))
      OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") CommandLine="*W901.ps1*")
      OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") CommandLine="*Bypass*" CommandLine="*Hidden*" CommandLine="*\\Temp\\*.ps1*" (ParentImage="*\\explorer.exe" OR ParentImage="*\\cmd.exe" OR ParentImage="*\\curl.exe")) )
| eval ioc_hit=case(match(CommandLine,"185\\.138\\.88\\.3|3112851459"),"clickfix_payload_host",match(CommandLine,"W901\\.ps1"),"w901_payload",true(),"curl_ps1_hidden_bypass_behaviour")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentImage) as parents values(ioc_hit) as ioc_hit by host User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let PayloadIndicators = dynamic(["185.138.88.3", "3112851459", "W901.ps1"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where
    (FileName =~ "curl.exe" and (ProcessCommandLine has_any (PayloadIndicators)
        or ProcessCommandLine matches regex @"(?i)https?://\d{8,10}(/|\s|$)"
        or (ProcessCommandLine has ".ps1" and ProcessCommandLine has "--ssl-no-revoke" and ProcessCommandLine has_any ("%TEMP%", @"\Temp\"))))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and (ProcessCommandLine has "W901.ps1"
        or (ProcessCommandLine has "Bypass" and ProcessCommandLine has_any ("Hidden", "-w hidden") and ProcessCommandLine matches regex @"(?i)\\Temp\\\S*\.ps1")))
    or (ProcessCommandLine matches regex @"(?i)curl\s.*https?://\d{1,3}(\.\d{1,3}){3}[^|]*\|\s*(zsh|bash|sh)\b")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: TypoPrompting ClickFix curl.exe Download of PowerShell Payload (W901.ps1)
id: c0a15888-0001-4a11-8b01-5e8800000101
status: experimental
description: Detects the TypoPrompting ClickFix command pasted into the Run dialog - curl.exe saving a .ps1 payload to the temp folder (W901.ps1 from 185.138.88.3 or 3112851459) followed by hidden, execution-policy-bypass PowerShell.
references:
    - https://www.island.io/blog/typoprompting-from-ai-typos-to-malware
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_curl:
        Image|endswith: '\curl.exe'
        CommandLine|contains|all:
            - '.ps1'
            - '--ssl-no-revoke'
    selection_ioc:
        CommandLine|contains:
            - '185.138.88.3'
            - '3112851459'
            - 'W901.ps1'
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Bypass'
            - 'Hidden'
            - '.ps1'
    selection_temp:
        CommandLine|contains:
            - '\Temp\'
            - '%TEMP%'
    condition: selection_curl or selection_ioc or (selection_ps and selection_temp)
falsepositives:
    - Administrators or software deployment scripts that use curl.exe to stage PowerShell scripts in a temp folder
level: high

```

**Known false positives:**

- Administrators or deployment tooling using curl.exe to stage PowerShell scripts in %TEMP% with execution-policy bypass
- Legitimate macOS developer installers that pipe curl output from a raw-IP URL into a shell

**Tuning notes:** Treat the payload host and W901.ps1 matches as high-fidelity alerts and keep the behavioural branch at medium. Exclude known software-deployment parent processes and service accounts. PowerShell may be launched with abbreviated switches (-ep, -w hidden); extend the Bypass/Hidden terms if needed. Restrict the macOS branch to Terminal parents if noisy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TypoPrompting ClickFix curl.exe to PowerShell W901.ps1 Execution — Exploitation (Sentinel KQL) (locked: unlock with TL Creds)
- TypoPrompting Net Guard and Quick Search Browser Hijack Persistence — Post-Exploitation (Sentinel KQL) (locked: unlock with TL Creds)
- TypoPrompting Typosquat, ClickFix Gate and Hijacker Infrastructure Contact — C2 Infrastructure (Sentinel KQL) (locked: unlock with TL Creds)
- TypoPrompting ClickFix curl.exe to PowerShell W901.ps1 Execution — Exploitation (Sigma) (locked: unlock with TL Creds)
- TypoPrompting Net Guard and Quick Search Browser Hijack Persistence — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- TypoPrompting Typosquat, ClickFix Gate and Hijacker Infrastructure Contact — C2 Infrastructure (Sigma) (locked: unlock with TL Creds)
- TypoPrompting Net Guard and Quick Search Browser Hijack Persistence — Post-Exploitation (Splunk SPL) (locked: unlock with TL Creds)
- TypoPrompting Typosquat, ClickFix Gate and Hijacker Infrastructure Contact — C2 Infrastructure (Splunk SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 35)

Defanged, TLP:CLEAR.

- IP address: `185.138.88[.]3`
- Domain: `cloude[.]ai`
- File hash: `bdddb50204d6867b4bd73d9cfe93cbc98c4518342da104e4608f04e675ac6cb3`

Full set of 35 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers](https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html)
- [TypoPrompting: From AI Typos to Malware (Island)](https://www.island.io/blog/typoprompting-from-ai-typos-to-malware)
- [How Attackers Use Sponsored Search and Custom GPTs in Malware Delivery (Island)](https://www.island.io/blog/how-attackers-use-sponsored-search-custom-gpts-in-malware-delivery)
- [Typosquatting Is No Longer a User Problem (The Hacker News)](https://thehackernews.com/2026/05/typosquatting-is-no-longer-user-problem.html)
- [Malicious Chrome extension captures AI query keystrokes (Cybernews)](https://cybernews.com/ai-news/malicious-chrome-extension-captures-ai-searches/)
- [Security researchers discover fake ChatGPT ads that trick you into downloading malware (Tom's Guide)](https://tomsguide.com/computing/malware-adware/security-researchers-discover-fake-chatgpt-ads-that-trick-you-into-downloading-malware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5888