The cybersecurity company says the addresses impersonate 27 brands and lead to three delivery paths. One involves 16 search-hijacking extensions with 972,000 declared users, whose queries can be sent to a third party.
Cybersecurity company Island says it found a delivery pattern it calls TypoPrompting across 186 domains that resemble addresses for superintelligence (SI) tools and impersonate 27 brands. Visitors can be directed to fake verification prompts, browser-hijacking software or extensions that redirect searches.
The 16 search-hijacking extensions had 972,000 declared users on their Chrome Web Store listings as of 3 November 2026, a listing count rather than a count of verified infections or victims. The listings were live when Island identified them. Island shared its findings with The Hacker News.
Some lookalike addresses, including cloude[.]ai and cluade[.]ai, were registered as early as 13 July 2023. That registration date does not establish when malicious delivery began.
In one route, a parked domain redirects a visitor through pages that identify browser characteristics and collect the visitor’s public IP address. A fake Cloudflare verification page then supplies a PowerShell command for the visitor to run.
Island says the browser-identification script spans a broader set of 211 entry domains, including addresses resembling those of banks, insurers and workplace software. The lures also include Windows verification prompts asking users to run a copied command, macOS terminal or security-update prompts seeking execution of a shell command, and archive downloads that ask users to extract and run a program.
A separate route uses eight lookalike domains to lead visitors to fake “Security Check” pages that deliver Net Guard. Island says the app can run attacker-controlled JavaScript, change the default search engine while a user is idle, edit browser profiles and install arbitrary Chrome extensions.
Net Guard presents itself as a Wi-Fi and domain-name-system safety scanner. Its MSIX package hash—a digital fingerprint of the installation package—matches that of a legitimate app with the same name, the report says.
Europol says this week’s Operation Endgame action targeted Gootloader, CastleRAT and StealC, while stolen data found on the infrastructure will help alert affected users.
The third route starts at preplexity[.]ai, a lookalike of Perplexity, and redirects visitors to the Quick Search extension in the Chrome Web Store. Island says Quick Search changes the default search provider to find.flashysearches[.]com through its manifest, the configuration file that tells the browser how an extension works. Its main action needs no executable JavaScript or declared permissions.
Searches through that provider go to a third party, Island says. Workplace searches could include internal hostnames, customer names and project details. The identified extension family also includes GPT for Chrome, whose listing had 80,000 users.
2 min
The Android XR glasses go on preorder on 12 November. Google says sensors will block photo and video capture if the recording light is covered or tampered with.
2 min
Cloudflare placed warnings before the reported destinations after the security company’s researchers flagged them through its abuse system.
3 min
