Mistype ChatGPT or Claude by one letter and you may land on a page that wants to run a command

Type cloude.ai instead of claude.ai, or chatgpy.com instead of chatgpt.com, and you'd expect an error page. You might get something much worse. Researchers at the security company Island have traced 186 lookalike web addresses imitating 27 AI services, among them ChatGPT, Claude, Gemini, Copilot, DeepSeek, Perplexity, Midjourney and ElevenLabs. Some were registered as long ago as July 2023. Island calls the scheme TypoPrompting.

Where you end up depends on the typo. The Claude lookalike passes visitors through a chain of redirects to a fake Cloudflare "verify you are human" page that tells Windows users to paste a command into the Run box. The command quietly downloads a PowerShell script and runs it. Other lookalikes show a fake security check offering Net Guard, an app dressed up as a Wi-Fi safety scanner. It's a genuine Microsoft Store package, which is part of the trick, but Island classes it as a browser hijacker: it can change Chrome's search engine while you're away from the keyboard, edit browser profiles and add extensions. A Perplexity typo leads instead to a Chrome extension that promises Bing results and sends your address-bar searches through a third-party site. Island counted 30 extensions built from the same kit, 13 since removed from the Chrome Web Store; those still listed had about 972,000 users between them on 3 November.

The defence is dull and it works. Bookmark the AI tools you actually use and open them from there. No real website needs you to press Windows+R and paste something. And a "security check" that wants you to install an app is the security risk.

If your browser's search engine keeps switching back after you change it, Tendvane's "browser hijacked" repair wizard goes through the usual causes.