Scammers use genuine Google sign-ins to sell costly, unverified AI subscriptions
Malwarebytes uncovered 100+ fake AI subscription sites built from a $249 toolkit, using genuine Google sign-in pages to sell unverified plans up to $2,000/year.
Malwarebytes found more than 100 scam websites impersonating or inventing AI products (GPT-6 Astra, DaVinci Resolve, PixAI, OpenCut, Omegle), all built from a $249 commercial starter kit and tied to closely related developer emails suggesting a single operator. The sites avoid fake password forms and malware, instead using polished product pages and genuine Google OAuth sign-in screens to appear legitimate before pushing paid subscriptions from under $10/month to over $2,000/year. Google's consent screens revealed developer contacts using free webmail addresses unconnected to the displayed brands; researchers advise verifying URLs and consent-screen developer details before paying.
- 100+ sites from one $249 toolkit, likely a single operator, sell fake AI subscriptions
- Genuine Google sign-in lends false legitimacy; no fake password forms or malware used
- Some sites collect uploaded documents or recordings before any product trial exists
- Prices range from under $10/month to over $2,000/year with no verifiable operator details
Full article578 words · extracted from helpnetsecurity.com · click to collapse
Scammers are using a $249 website toolkit to sell unverified AI subscriptions worth up to $2,000 a year, and a genuine Google sign-in screen is what makes the sites convincing.
Malwarebytes found more than 100 websites built this way, all tied to the same toolkit and closely related developer details.
The network includes sites that copy the names of existing products, among them GPT-6 Astra, DaVinci Resolve, PixAI, and OpenCut. One site uses the name Omegle, the video chat service that shut down in 2023. Other sites promote brand names with no public history behind them.
A fake PixAI generator site (Source:Malwarebytes)
“The sites we examined did not use fake password forms or push malware downloads. Instead, they used polished product pages and genuine Google sign-in screens before directing visitors to paid plans. Someone visiting an imitation site could believe they were buying from the genuine provider. With the unfamiliar brands, it is difficult to establish who is selling the subscription or independently verify the claims being made,” researchers explained.
Premium prices built on a cheap template
Prices on the sites range from under $10 a month to more than $2,000 a year. Several sites also ask users to upload documents or recordings for the advertised tool to process, before any option to try the product exists.
Researchers traced the sites to a commercial website starter kit priced at $249 as a one-time purchase, with additional templates costing around $2 each. The kit includes an account system, billing tools, file storage, and admin controls. Buyers add their own branding and product description on top.
Some sites still carry leftover material from the kit itself, including demo banners and testimonials that were never written for the product being sold. On one site, the word “boilerplate” remained visible in the name of a paid plan.
“Despite their different names and designs, the sites share identical underlying files and closely related developer email addresses. This suggests that a single operator, or closely connected group, is behind the network,” they noted.
The sites give almost no information about who operates them. There is usually no company name, no business address, and no independently verifiable contact beyond an email address on the site’s own domain, which could make a refund or a dispute difficult.
Google sign-in doesn’t guarantee trust
Sites in the network send visitors to an authentic Google sign-in page, which requests a name, email address, and profile picture without asking for access to Gmail or Drive. A genuine Google sign-in only confirms that Google handled the login, not that the product behind it is legitimate.
Google’s consent screen shows the application name and the developer contact linked to the sign-in request. On the sites Malwarebytes examined, several of these developer contacts were free webmail addresses, not addresses tied to the brand displayed on the page.
“A free email address is not proof of wrongdoing, but it should raise questions when a service claims to have millions of users or presents itself as an established company,” Malwarebytes warned.
Malwarebytes recommends confirming the web address matches the product a user intended to use, rather than trusting the logo or name alone. It also recommends reading the Google consent screen before continuing, checking the application name and developer details against the brand shown on the site.
“Search for the product separately and look for an official website or app-store listing. Do not rely on ratings and testimonials displayed by the seller,” researchers concluded.