Security company Island discovered 186 counterfeit AI domain names

According to Cryptopolitan, the security company Island released a study on November 12, revealing 186 counterfeit domains mimicking 27 well-known AI brands. Among them, ChatGPT was the most impersonated, with 25 similar domains, followed by Claude with 18, DeepSeek with 16, and Runway with 12. Some of these similar domains redirect users to advertising pages, while others point to malicious websites.

The study states that attackers implement their attacks using a technique called TypoPrompting, exploiting spelling errors made by users when entering AI tool URLs. Island tracked three related pathways: redirecting visitors to a fake Cloudflare verification page and enticing Windows users to execute PowerShell commands; promoting a disguised security check application called Net Guard, which can hijack browsers and run remote scripts; and involving 30 browser extensions that hijack searches, of which 13 have been removed, while the remaining 17 collectively have 972,000 users. Island noted that the 186 fake domains are a count of the number, not confirmed infection cases, and it has not yet been confirmed that this activity has caused any losses.