Security firm Island identified 186 fake domains impersonating 27 major AI brands, including ChatGPT, Claude, DeepSeek, and Runway, according to research released on November 12. ChatGPT was the most targeted brand with 25 lookalike domains, followed by Claude with 18, DeepSeek with 16, and Runway with 12. Attackers exploit a technique dubbed "TypoPrompting," leveraging common typos users make when typing AI tool URLs to redirect traffic to malicious sites or advertising pages. Island traced three distinct attack vectors linked to these domains: forged Cloudflare verification pages that trick Windows users into executing PowerShell commands; a "Net Guard" app disguised as a security check capable of hijacking browsers and running remote scripts; and 30 search-hijacking browser extensions. Of those extensions, 13 have been removed, while the remaining 17 collectively reach approximately 972,000 users. Island emphasized that the 186 domains represent discovered instances rather than confirmed infections, with no reported losses from the campaign so far.