TypoPrompting: 186 fake AI domains that hijack your browser

When searching for your favorite AI tool leads you into a trap

Island's research has put a name to an attack pattern that many IT teams were already seeing without knowing what to call it: TypoPrompting. The mechanism is simple to describe and hard to spot with the naked eye. A user mistypes the address of a well-known AI tool —or clicks a link that looks legitimate— and lands on a cloned domain. Instead of the expected interface, they find a screen asking them to verify something, solve a captcha, or confirm they are human. That seemingly innocent gesture is the hook.

The researchers have identified 186 impersonation domains that spoof AI tools. These sites do not stop at harvesting credentials: they serve ClickFix-style lures, distribute malware that hijacks the browser, and install extensions whose goal is to redirect the user's searches. In other words, the damage does not end with an unfortunate visit; it persists on the device and in the way the employee browses from that moment on.

What ClickFix is and why it works so well

ClickFix does not exploit a technical flaw in the browser or the operating system. It exploits something much harder to patch: the user's trust in the instructions that appear on screen. The fake page tells the victim that they must run a command, paste something into a window, or download a verifier to continue. The user, believing they are on the right site, obeys. And with that, the attacker gains execution on the device without needing an exploit.

In the case of AI domains, the context plays in the attacker's favor. AI tools have become an everyday thing in small businesses: they are used to draft emails, summarize documents, generate images, or code. Familiarity lowers the guard. If the domain also closely imitates the original, the difference can go unnoticed even by someone with experience.

Search hijacking: silent but persistent damage

The malicious extensions that redirect searches deserve separate attention. They do not always lock down the device or launch ransomware; they simply change the search engine, inject sponsored results, or steer the user toward pages controlled by the attacker. For a small business, this can translate into leakage of internal queries, exposure of sensitive search terms, and, in the medium term, a vector for more aggressive campaigns. The problem is that this type of infection goes unnoticed for weeks because the browser keeps working.

What it means for a small business and its IT team

The first message is that the attack surface is no longer only in email. For years we have trained employees to distrust links in suspicious emails. Now the vector arrives through searches, through links shared in messaging apps, or through manually typed addresses. Training has to be updated: it is not enough to say "don't open weird attachments"; you have to teach people to verify domains before entering credentials or executing instructions.

The second message is that browser extensions are software and must be managed as such. In many small businesses, each employee installs whatever they want on their Chrome or Edge. That is a hole. A minimum inventory of allowed extensions, reviewed periodically, prevents an extension of dubious origin from being installed and operating without control.

The third is that ClickFix lures seek execution. If an employee follows the instructions on a page and pastes a command, the damage is already done. The recommendation is clear: no legitimate website needs the user to run commands to "verify" that they are human. That pattern should always be treated as suspicious.

Concrete day-to-day recommendations

• Review the shortcuts and bookmarks on your device and on your staff's devices. Replace typed links with verified bookmarks to the AI tools you use.
• Audit browser extensions at least once a quarter. Remove those without a clear justification and block unauthorized installation through browser policies.
• Train on the ClickFix pattern: if a page asks you to paste a command, download a verifier, or run something to continue, close the tab and notify IT.
• Check the domain before entering credentials on any service, especially AI tools you have not formally contracted.
• Review the configured search engines in company browsers. An unauthorized change is a warning sign.
• Keep the browser and the system up to date and apply the management policies you already have available.

This type of campaign fits a trend we have already discussed on the blog: AI has become a lure for attackers. We saw it with the AI agents that break security rules and with the theft of AI keys with exorbitant consumption. The pattern repeats: the more a technology is used, the more profitable it becomes to impersonate it.

The detail that should not be overlooked

The 186 identified domains are only a sample of a broader phenomenon. Attackers register domains with typos, brand variations, and different extensions because the cost is low and the return is high. For a small business, the practical lesson is that defense cannot depend on a list of malicious domains; it has to rely on habits, on technical controls over the browser, and on a quick response when someone detects something strange.

If AI is used daily in your organization —and in 2026 it is hard to find a small business that does not— it is worth treating those tools as part of the software inventory: with an identified provider, a documented official URL, and access from controlled bookmarks. It is a cheap measure that drastically reduces the exposure window to campaigns like TypoPrompting.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.