Fake sites posing as popular AI tools hide malware behind a phony verification check

A single dropped letter is enough. Type chatgpy instead of ChatGPT, or cloude instead of Claude, and the browser lands on a parked page that looks harmless until its traffic filter decides the visitor is worth attacking. Windows users then meet a screen that claims to be a Cloudflare verification check and tells them to paste a command to prove they are human.

Read next on Morning Overview: Over 20 trillion gallons of rain fell on the Four Corners states and Nevada in two weeks

Security firm Island mapped that funnel and named it TypoPrompting. In research published in November, with a snapshot dated Nov. 3, it counted 186 lookalike domains covering 27 AI brands, and the command that visitors are told to paste fetches a PowerShell script.

186 domains and 27 brands of misspelled AI

According to Island’s TypoPrompting report, the targets read like a directory of the AI boom. Claude has 18 lookalikes, ChatGPT has 25, the most of any brand, DeepSeek has 16, and Perplexity, Lovable and Character.ai have 11 apiece. Gemini, Grok, Mistral, NotebookLM, Manus, Midjourney, Runway, ElevenLabs, Copilot, Kling, HeyGen, Suno, Leonardo, Cursor, OpenAI and Anthropic also appear.

The typos are ordinary ones: neighboring keys, swapped letters, dropped or doubled characters. Island found early registrations on July 13, 2023, when several Claude and Perplexity typos were registered together, and video-tool lookalikes were added through 2023 and 2024. Kling lookalikes followed on March 27, 2026, so the portfolio has been growing for more than three years rather than appearing overnight.

Island also traced older payloads to individual typos. An installer archive named for ChatGPT came from a lookalike seen in October and November 2026 and was flagged by 9 of 16 MetaDefender engines, an Aurora stealer payload came from a Midjourney lookalike in 2023, and an Android banking trojan called OctoV2 came from a DeepSeek lookalike in early 2025. The infrastructure has delivered different malware at different times, which suggests a reusable traffic business rather than a single-purpose attack.

The fake Cloudflare check and the hidden PowerShell

The report by The Hacker News describes the lure as ClickFix, a technique in which the page itself persuades the victim to run the malicious command. Microsoft Threat Intelligence, in an August 2025 analysis of ClickFix, described lures dressed up as human-verification checks, including spoofed Cloudflare Turnstile pages, that get users to paste commands into the Run dialog, Windows Terminal or PowerShell. Island’s analysis shows a parked page sending visitors through a traffic-distribution system that filters by country, operating system and browser. Windows visitors get the verification screen and an instruction to paste a command into the Run dialog.

The command uses curl.exe to save a script named W901.ps1 into the temp folder, then runs it in a hidden PowerShell window with no profile and an execution-policy bypass. The host address is written as a single decimal number to slip past filters that look for dotted addresses. Mac visitors see a fake Terminal update with a curl pipeline into zsh instead, and other systems get archive downloads.

Oleg Zaytsev, Island’s lead security researcher and the report’s author, notes that the same gate script turned up in 550 scan records across 211 entry domains between April 2025 and November 2026. Those entry domains include lookalikes of Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow and Microsoft Azure, so the machinery is not limited to AI names.

Two other routes: a signed installer and a search hijacker

Not every typo leads to the fake verification screen. Eight of them pass through a redirector to fake Security Check pages that deliver an MSIX package whose hash matches a real Microsoft Store listing, published under the name Myflixly App. Island says its code can switch the default search engine while the user is idle, run remote JavaScript in the browser, and edit browser profiles to install extensions, with those features enabled by default.

A third route starts from a Perplexity typo and ends at a site that installs a Chrome extension overriding the default search provider. Island found 30 extensions from the same kit, 13 of which had been removed, while the remaining 17 showed 972,000 users on Nov. 3. A Store signature, Zaytsev argues, does not show what an app does inside the browser, which is why Island urges policies based on package family, publisher and hash.

The wider funnel behind the signed installer is large. Island counts 191 lander domains and 1,437 source domains, and the analyzed packages carried names such as Net Guard, Privacy Keeper and MyFlixly Browser. The welcome screens in those packages count down 30 seconds before turning on browser sync, and they do not disclose the browser changes the software makes, which is how the unwanted behavior gets past a casual user.

Defenses Island recommends

For companies, Island’s advice starts with removing the reason to type an address from memory: give staff a direct route to approved AI services through managed bookmarks, and block confirmed lookalikes. It also recommends correlating browsing with Run-dialog or Terminal activity, since a hidden PowerShell window with an execution-policy bypass or a decimal IP address is a strong signal, and setting an approved search provider and extension policy.

Other vendors have been charting adjacent campaigns around AI brands, including Sophos on attackers impersonating AI brands and Island’s separate analysis of fake AI advertising. The part of TypoPrompting that remains unsettled is its operator: Island ties many domains to a shared redirector registered on March 6, 2026, and an 81-domain portfolio, but the report does not name who runs it.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.