A batch of 186 lookalike domains impersonating artificial intelligence products has been mapped by researchers at Island, who have tagged the campaign TypoPrompting. TheHackerNews, which carried the findings, reported that the domains funnel visitors into ClickFix-style lures, browser-hijacking malware, and a set of extensions that rewrite user searches.
The count is the part of the story worth dwelling on. A stray misspelled domain parked for a quick credential grab is a nuisance; 186 independently registered addresses working as a repeatable delivery pipeline is infrastructure. It points to an operator — or several — treating AI-brand impersonation as a supply line rather than a one-off trick.
From typo to payload
Reading across the reporting, the chain runs through roughly five stages — this is a reporter's summary of the pattern rather than an enumeration confirmed by Island:
- Domain. The user mistypes, or is redirected, to a lookalike address standing in for a well-known AI product.
- Interstitial. The fake site presents a convincing enough version of the tool to keep the visitor reading.
- Paste instruction. In place of a login form, the page displays a "verification" or "fix" prompt — ClickFix-style text telling the user to paste a command.
- Execution. The victim runs the attacker's code by hand, skipping the download-and-open step most users have been trained to question.
- Persistence. Browser-hijacking malware and search-rewriting extensions take up residence, holding the foothold after the tab closes.
Island characterised the lures as "AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify" — a line that captures why the deception lands. The pivot is social rather than technical: the lookalike domain only has to buy a moment of inattention. The payload arrives through the victim's own actions, which is exactly why ClickFix-style instructions slip past habits built around refusing suspicious downloads.
AI tools are unusually good bait for this pattern. They draw heavy traffic, many have short names that invite transposition errors, and their users are already conditioned to accept permission requests and verification prompts as routine. Suspicion is lowest at precisely the wrong moment.
What defenders should do
Scale dictates the response. A spread of 186 domains cannot be cleared with one-off takedowns; the countermeasure has to be standing rather than reactive.
- Watch for brand lookalikes continuously, covering newly registered domains that match your product name or common misspellings — registration, not just resolution, is the earlier signal.
- Block or sinkhole confirmed bad domains at the DNS layer, so protection does not rest on every user judging every link correctly.
- Treat "paste this to fix it" instructions as hostile by default. Train staff to spot the pattern itself, not merely fake login pages.
- Govern browser extensions centrally. Search-hijacking extensions persist because installs go unmonitored; allow-listing and periodic audits close that gap.
- Combine email and web filtering with endpoint detection, because the chain crosses several control planes and no single filter sees all of it.
For Hong Kong enterprises, the practical translation is unremarkable but worth stating: the same controls — DNS-level blocking, extension allow-lists, and staff briefed on ClickFix prompts — apply whatever the campaign's origin, and the 186-domain figure offers a useful benchmark for sizing a typosquat monitoring programme.
The broader lesson for the open-source and IT community is that typosquatting has graduated. It is no longer a parking-page problem but the opening link in an infection chain — and the cheapest place to cut that chain is before the user ever sees a prompt to verify.
Island 的研究人員已將一批共 186 個仿冒域名（lookalike domains）加以追蹤，這些域名冒充人工智能產品，研究人員將該行動命名為 TypoPrompting。刊載有關發現的 TheHackerNews 報道稱，這些域名把訪客導入 ClickFix 形式的誘餌、瀏覽器劫持惡意軟件，以及一組可改寫用戶搜尋結果的擴充功能。
是次事件最值得留意的，在於域名的數量。一個錯拼、停放於網絡上用以快速套取登入憑證的域名，只不過是滋擾；然而 186 個獨立註冊、共同運作成為一條可重複使用的投放管線的地址，已屬基礎設施。這指向有營運者——或不止一個——把冒充 AI 品牌視為一條供應線，而非一次性伎倆。
從錯拼到惡意載荷
綜合各項報道，整條鏈大致經歷五個階段——以下是記者對有關模式的歸納，並非 Island 確認的完整列舉：
- 域名。用戶輸入錯誤，或被重新導向至一個仿冒地址，冒充一個知名的 AI 產品。
- 過渡頁面。假網站展示出足以令人信以為真的工具版本，令訪客繼續瀏覽。
- 貼上指令。頁面並非提供登入表單，而是顯示一個「驗證」或「修復」提示——即 ClickFix 形式的文字，指示用戶貼上一段指令。
- 執行。受害者親手執行攻擊者的代碼，繞過了「下載並開啟」這一步——而大多數用戶已被訓練成會對此步驟心生懷疑。
- 持續駐留。瀏覽器劫持惡意軟件及改寫搜尋結果的擴充功能從此安頓下來，在分頁關閉後仍守住該立足點。
Island 形容這些誘餌為「AI 應用仿冒品，把一次尋常的工具使用嘗試，扭轉成一道驗證提示」——這句話精準概括了為何欺騙得以奏效。其轉折點在於社交層面而非技術層面：仿冒域名只需爭取到片刻的疏忽即可。惡意載荷透過受害者自身的動作送達，這正是 ClickFix 形式的指令得以繞過用戶一向針對可疑下載所養成的防範習慣的原因。
AI 工具對此模式而言是異常有效的餌。它們流量龐大，不少名稱簡短、容易出現字母顛倒的輸入錯誤，而其用戶早已習慣把權限請求及驗證提示視為例行公事。懷疑精神偏偏在最不適當的時刻降到最低。
防守方應採取的措施
應對方式須視乎規模。186 個域名無法靠一次性取締清除；反制措施必須是常設而非事後反應。
- 持續監察品牌仿冒域名，涵蓋新註冊且與你產品名稱或常見錯拼相符的域名——註冊（而非僅是 DNS 解析）才是較早的預警信號。
- 在 DNS 層面阻擋或 sinkhole 已確認的惡意域名，使防護不至於依賴每一名用戶正確判斷每一個連結。
- 預設把「貼上這段指令以修復」視為敵意指令。培訓員工辨認該模式本身，而不僅是識別虛假登入頁面。
- 集中管理瀏覽器擴充功能。改寫搜尋結果的擴充功能之所以持續存在，是因為安裝過程未受監察；允許清單（allow-listing）及定期審計可填補這一漏洞。
- 把電郵及網頁過濾與端點偵測結合使用，因為整條鏈跨越多個控制平面，單一過濾器無法窺見全貌。
對香港企業而言，實際應用並不新奇，但值得一提：同一套控制措施——DNS 層面阻擋、擴充功能允許清單，以及就 ClickFix 提示向員工作出簡報——無論行動源自何方都同樣適用，而 186 個域名的數字則為規劃域名仿冒監察計劃的規模提供了一個有用的基準。
對開源及 IT 社群而言，更廣泛的啟示是：域名仿冒（typosquatting）已經升級。它不再是停放頁面的問題，而是感染鏈的起始一環——而要斬斷這條鏈，成本最低的下手點，就是在用戶從來未見到驗證提示之前。