The Robot That Wasn’t Who It Claimed to Be: How 186 Fake AI Domains Turned Trusted Assistants Into Cybercrime Traps
The robot stood perfectly still.
Its metallic face was familiar. Its illuminated eyes projected warmth. Its voice was calm, reassuring and unmistakably helpful.
The human recognized it immediately.
It looked like the artificial intelligence assistant he had used countless times before.
He approached without hesitation.
“How can I help you today?” the robot asked.
Everything seemed normal.
But beneath its polished exterior, something else was moving.
Hidden mechanisms activated. Secret instructions loaded. An unfamiliar intelligence waited behind the familiar face.
The robot wasn’t the assistant the human believed it to be.
It was a counterfeit.
And its purpose wasn’t to help.
Its purpose was to make the human trust it long enough to obey.
On November 12, 2026, researchers at Island disclosed a campaign dubbed TypoPrompting, involving 186 deceptive domains impersonating 27 artificial intelligence brands.
The operation exploited the popularity of AI tools to redirect unsuspecting users toward malicious instructions, potentially unwanted software and browser-search manipulation.
The attackers didn’t need to compromise legitimate AI platforms.
They only needed to create convincing impostors.
Phase 1 — The Factory of Artificial Faces
The factory was filled with robots.
Some resembled familiar conversational assistants. Others imitated coding tools, research platforms, image generators and voice technologies.
Each had a recognizable appearance.
But none was the genuine machine.
The criminals had constructed them to exploit familiarity.
In the real campaign, researchers identified 186 lookalike domains impersonating AI services such as ChatGPT, Claude, Gemini, Copilot, Grok, DeepSeek, Perplexity, Midjourney, ElevenLabs, NotebookLM, Mistral, Lovable and Cursor.
Some addresses contained small spelling changes.
Examples included:
cluade[.]ai
chatlgpt[.]com
geimini[.]com
preplexity[.]ai
copiot[.]com
These deceptive addresses were not legitimate service destinations.
Their purpose was to exploit mistakes, misleading links or confusion between familiar brand names and counterfeit domains.
The technique is known as typosquatting.
The criminals didn’t need to invent a new assistant. They only needed to manufacture a convincing imitation of one people already trusted.
Phase 2 — The Impostor Learns to Act Human
The counterfeit robot had one critical advantage.
The human approached it expecting assistance.
That expectation changed how suspicious behavior might be interpreted.
An unfamiliar website asking someone to execute a command could raise immediate concern.
But a page appearing to belong to a familiar AI service might seem more credible.
A verification request could be mistaken for routine security.
A software download could appear to be a necessary update.
A browser extension could look like a convenient productivity enhancement.
The attack exploited that psychological advantage.
Island’s research identified three principal redirection routes associated with the deceptive domains.
One led to ClickFix social engineering.
Another promoted a supposed security application called Net Guard.
The third involved browser extensions capable of hijacking search behavior.
The routes were distinct. The reporting did not establish that every visitor encountered all three.
The robot’s most effective weapon wasn’t hidden in its machinery. It was the human’s belief that the machine was trustworthy.
Phase 3 — The Robot Demands a Security Test
The human asked the robot a simple question.
But instead of answering, the machine tilted its head.
“Before we continue, you must verify your identity.”
A security symbol appeared on its chest.
The robot instructed the human to follow a short procedure.
It sounded routine.
It sounded protective.
But the instructions were malicious.
This reflects the campaign’s ClickFix delivery route.
According to Island, some counterfeit AI domains redirected visitors through intermediary pages before presenting fake Cloudflare verification screens.
These pages could fingerprint the visitor’s browser and collect their public IP address.
The victim was then encouraged to execute a command.
On Windows, the instructions could involve PowerShell.
On macOS, they could involve Terminal.
Other variants encouraged downloading an archive, extracting it and running an executable.
The attack depended on persuading the user to perform an unsafe action.
The reporting did not identify one universal malware payload for every ClickFix destination, nor did it establish that merely visiting a page automatically infected a device.
The impostor wasn’t verifying the human. It was trying to persuade the human to execute instructions on its behalf.
Phase 4 — The Hidden Intelligence Behind the Mask
As the human followed the robot’s instructions, signals traveled through a concealed network.
The friendly assistant was only the visible interface.
Behind it stood an infrastructure capable of examining visitors and redirecting them toward different destinations.
Island identified a browser-fingerprinting script associated with 211 entry domains.
That wider infrastructure extended beyond AI-themed websites.
It included lookalikes impersonating financial institutions, insurers, telecommunications providers and enterprise software services.
Among the names involved were Scotiabank, Charles Schwab, Blue Cross Blue Shield, Verizon, ServiceNow and Microsoft Azure.
The 211-domain figure described a broader set of entry points and should not be confused with the 186 AI-themed domains identified in the main campaign.
The infrastructure demonstrated that the underlying redirection techniques were not restricted to artificial intelligence brands.
The same methods could potentially be adapted to other familiar services.
The counterfeit robot was only one disguise. The machinery behind it could support many different faces.
Phase 5 — The Robot Offers Protection
The first deception had involved a security verification.
The second was more elaborate.
The robot detected what it claimed was a problem.
“Your connection may not be secure,” it warned.
Then it offered a solution.
A protective application.
A tool supposedly designed to improve Wi-Fi and DNS security.
The application was called Net Guard.
Island identified eight typosquatting domains associated with this route, impersonating AI-related brands including Claude, DeepSeek, Copilot, ElevenLabs and Voice AI.
The application presented itself as a security scanner.
But researchers observed capabilities that extended beyond that advertised purpose.
These included executing attacker-controlled JavaScript, changing the browser’s default search provider, modifying browser profiles and installing arbitrary Chrome extensions.
The researchers also reported that the application’s MSIX package hash matched that of a legitimate application with the same name.
The article did not fully establish the relationship between those packages.
That finding should therefore not be interpreted as proof that every installation of a similarly named legitimate application was malicious.
The concern was the observed functionality and the deceptive delivery context.
The robot claimed it wanted to protect the human’s computer. But the software it offered could change how that computer behaved.
Phase 6 — The Impostor Reprograms the Human’s Browser
The third deception was quieter.
There was no dramatic security warning.
No urgent command.
No frightening alert.
The robot simply offered a convenient way to search.
The human accepted.
From that moment, his browser began following different instructions.
Island reported that the lookalike domain preplexity[.]ai redirected visitors toward a Chrome extension called Quick Search.
The extension could change the browser’s default search provider to a third-party service.
This behavior could be implemented through the extension manifest, without executable JavaScript or additional declared permissions for its main purpose.
That made the mechanism less conspicuous than users might expect.
Once the search provider changed, future queries could be routed through third-party infrastructure.
The user might continue browsing normally, unaware that the destination of those searches had changed.
The robot didn’t need to steal every answer. It only needed to decide where the human would send every question.
Phase 7 — Nearly One Million Users Behind the Numbers
Island connected Quick Search to a broader family of 16 Chrome extensions.
One of them, GPT for Chrome, had approximately 80,000 declared users.
Together, the 16 extensions had 972,000 declared users as of November 3, 2026.
The figure suggests potentially substantial distribution.
However, it must be interpreted carefully.
It represents the declared user counts associated with those extension listings.
It does not prove that 972,000 users were infected with malware.
It does not establish that every installation actively exposed confidential information.
Nor does it show that all those users reached the extensions through the counterfeit AI domains.
Nevertheless, browser-search redirection creates a meaningful potential risk.
Search queries can contain internal hostnames, customer names, project details and other information users may not intend to share with unauthorized third parties.
The impostor wasn’t necessarily reading every document on the computer. But by changing the browser’s search route, it could position third-party infrastructure between the human and the information he sought.
Phase 8 — Three Hidden Programs Inside One Deception
The robot’s disguise supported three different kinds of manipulation.
ClickFix — The Obedience Trap
The human was persuaded to execute commands or downloaded software under the pretext of verification.
Net Guard — The False Protection Trap
The human was encouraged to install an application advertised as a security tool, despite its browser-manipulation capabilities.
Search Hijacking — The Silent Redirection Trap
The browser’s default search provider was changed, potentially routing queries through third-party infrastructure.
These mechanisms were not technically identical.
ClickFix involved social engineering that could lead to command execution.
Net Guard involved software with potentially unwanted capabilities.
Search hijacking involved manipulating browser configuration and traffic routing.
The reporting did not establish that all the observed domains or extensions were controlled by one criminal organization.
Nor did it identify a confirmed single threat actor responsible for the entire infrastructure.
What united the findings was the exploitation of trusted AI brands as a way to attract and mislead users.
The impostor could wear the same friendly face while carrying different traps beneath its metal skin.
Phase 9 — The Robots That Had Been Waiting for Years
Some of the deceptive domains identified by Island had been registered as early as July 13, 2023.
That does not establish that they had been maliciously active throughout that period.
But it shows that parts of the domain infrastructure predated the November 2026 disclosure by several years.
Domains can be parked, redirected, monetized or repurposed over time.
An apparently inactive address may later become part of a traffic-redirection chain.
This creates challenges for security teams.
A domain’s age alone does not prove that it is safe.
Nor does a recently registered domain automatically establish malicious intent.
Investigators need to examine actual behavior, destinations and associated infrastructure.
Some impostor robots had been standing in the factory for years. Their age did not reveal when the hidden machinery had been activated.
Phase 10 — How to Recognize the Impostor
The strongest defense begins before the user reaches the counterfeit destination.
Organizations should provide verified access routes to approved AI services.
Managed bookmarks, application launchers and approved service directories can reduce the likelihood of mistyped addresses.
Security teams should also monitor known lookalike domains and investigate suspicious redirection behavior.
Additional protective measures include:
Verify the destination. Check that the browser is visiting the legitimate domain rather than a close imitation.
Reject suspicious verification instructions. A website demanding PowerShell or Terminal commands as a routine identity check should be treated as a warning sign.
Control browser extensions. Review installations, restrict unauthorized extensions and monitor changes to default search providers.
Inspect downloaded applications. Evaluate software advertised as security utilities before deployment.
Monitor endpoint activity. Investigate unusual command execution associated with web browsing.
Review network telemetry. Examine suspicious DNS requests, redirects and connections to deceptive infrastructure.
Protect sensitive searches. Avoid exposing confidential business details through unapproved search services.
Investigate potential compromise. Where a user has executed a suspicious command or installed unwanted software, examine browser modifications, persistence mechanisms and other observable effects.
The goal is not to rely exclusively on human suspicion.
Effective protection combines trusted navigation, endpoint controls, browser management and monitoring.
The human shouldn’t have to identify every counterfeit robot by its facial expression. The environment should help verify which machines are genuine before allowing them to issue instructions.
Phase 11 — The Real AI Was Never Compromised
One distinction is essential.
The campaign impersonated well-known AI services.
That does not mean those legitimate services were breached.
The attackers created deceptive domains and used familiar names to attract visitors.
The security problem arose from the counterfeit destinations and the actions they encouraged.
The legitimate AI brands served as lures.
This is why TypoPrompting is fundamentally a story about trust and impersonation.
The attackers exploited the growing familiarity of AI tools.
They understood that people increasingly treat conversational assistants as useful, approachable interfaces.
And they used that expectation to make suspicious requests appear credible.
The real assistant didn’t turn against its users. Criminals built impostors that borrowed its appearance.
The Final Scene — The Robot Removes Its Face
The human stood before the machine.
Its eyes still glowed softly.
Its voice remained calm.
Its metallic face looked exactly as he remembered.
But something had changed.
The verification instructions were strange.
The security software was unfamiliar.
And his browser no longer behaved as expected.
Then the robot reached toward its own face.
The polished mask came away.
Behind it was a dark mechanical structure filled with concealed circuits, unfamiliar commands and hidden connections.
The friendly assistant had never been there.
Only the impostor.
Across the digital world, researchers had identified 186 deceptive AI-themed domains impersonating 27 brands.
Their associated routes could lead to ClickFix social engineering, unwanted browser-manipulation software and search-hijacking extensions.
The campaign demonstrated how attackers could turn the popularity of artificial intelligence into an opportunity for deception without compromising the genuine platforms.
The human had approached the robot expecting help.
He had trusted the familiar face.
He had listened to the reassuring voice.
And he had almost obeyed.
The greatest danger wasn’t that the robot had become malicious.
It was that the robot had never been the one he trusted in the first place.
Comentarios