---
id: "CMP-202611-volmsb"
page: "https://infrastack.ai/live/CMP-202611-volmsb"
kind: "campaign"
aliases: []
title: "TypoPrompting: 186 misspelled AI tool domains (cloude.ai, chatlgpt.com, preplexity.ai...) push ClickFix PowerShell commands, the Net Guard browser hijacker and search-hijacking Chrome extensions (Island)"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Google Chrome", "fixed": []}, {"name": "ChatGPT", "fixed": []}, {"name": "Claude", "fixed": []}, {"name": "Perplexity", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-12T15:34:10+00:00"
updated_at: "2026-11-12T15:35:39+00:00"
sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html", "first_seen_at": "2026-11-12T15:34:10+00:00", "cites": ["https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html"]}]
exploit_sources: []
---

# TypoPrompting: 186 misspelled AI tool domains (cloude.ai, chatlgpt.com, preplexity.ai...) push ClickFix PowerShell commands, the Net Guard browser hijacker and search-hijacking Chrome extensions (Island)

Link for people: https://infrastack.ai/live/CMP-202611-volmsb (this .md is for agents)

Island found 186 lookalike domains for 27 AI brands (Claude, ChatGPT, Gemini, NotebookLM, Copilot, Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, Cursor). Someone who mistypes the address gets one of three things: a fake Cloudflare check that tells them to paste a PowerShell command on Windows or a shell command on macOS, or to download and run an archive (ClickFix); a fake 'Security Check' page that installs Net Guard, a browser hijacker that runs attacker JavaScript, changes the search engine and installs Chrome extensions; or the Quick Search Chrome extension, which sends every search to find.flashysearches[.]com. Quick Search is one of 16 such Chrome Web Store extensions, including 'GPT for Chrome', with 972,000 users in total (3 Nov 2026). The same fingerprinting script also sits on lookalike domains for Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow and Microsoft Azure (211 entry domains). Some domains were registered as early as 13 Jul 2023. Which organisations were hit is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Google Chrome affected range not listed fixed no fixed version listed
- :ChatGPT affected range not listed fixed no fixed version listed
- :Claude affected range not listed fixed no fixed version listed
- :Perplexity affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the victims are unknown and does not describe how an attacker got into any organisation, while users who mistyped AI tool domains were led to install Net Guard, Chrome extensions such as Quick Search and GPT for Chrome, or to paste ClickFix commands.

How it reached others: their users installed or auto-updated it (tampered-install).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#tampered-install

## How to check

DNS or proxy logs with visits to cloude[.]ai, cluade[.]ai, clsude[.]ai, chatlgpt[.]com, geimini[.]com, notebookklm[.]com, griok[.]com, preplexity[.]ai, deepceek[.]com, elevenlebs[.]io, copiot[.]com, midj0urney[.]org (the full list of 186 is in Island's report). Browsers whose default search engine is find.flashysearches[.]com, or that have the 'Quick Search' or 'GPT for Chrome' extension. A 'Net Guard' MSIX app installed on Windows. A browser 'verify you are human' or 'security update' page that asks you to paste a command into Run, PowerShell or Terminal.

## Fix

Bookmark the real AI tool URLs, or push them from your management tools, and block the listed lookalike domains. Remove Quick Search, GPT for Chrome and other extensions that change the search engine, and allow-list extensions where you can. Uninstall Net Guard. If someone pasted a command from one of these pages, treat the machine as infected: isolate it and change the passwords and tokens used on it.

## Timeline

- 2026-11-12T15:34:10+00:00 analyst https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html

## Documents

- [describes] @TheHackersNews: 🚨 186 fake domains impersonate ChatGPT, Claude, Gemini and 24 other AI brands.

 https://x.com/TheHackersNews/status/2120898921711157320
- [describes] 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_