According to ChainCatcher citing Cryptopolitan, security firm Island said in a study published November 12 that it found 186 domains impersonating 27 well-known AI brands. ChatGPT was the most impersonated, with 25 lookalike domains, followed by Claude with 18, DeepSeek with 16 and Runway with 12. Some domains redirected users to ads, while others led to malicious sites.
Island said attackers used “TypoPrompting,” exploiting misspellings when users entered AI tool URLs. The three observed tactics included fake Cloudflare verification pages that prompted Windows users to run PowerShell commands; a browser-hijacking Net Guard app that ran remote scripts; and 30 browser extensions that hijacked searches. Thirteen extensions had been removed, while the remaining 17 had 972,000 users combined. Island said the 186 domains were a count, not confirmed infections, and no losses from the activity had been confirmed.