Scammers use genuine Google sign-ins to sell costly, unverified AI subscriptions
Malwarebytes uncovered 100+ fake AI subscription sites built from a $249 toolkit, using genuine Google sign-in pages to sell unverified plans up to $2,000/year.
Malwarebytes found more than 100 scam websites impersonating or inventing AI products (GPT-6 Astra, DaVinci Resolve, PixAI, OpenCut, Omegle), all built from a $249 commercial starter kit and tied to closely related developer emails suggesting a single operator. The sites avoid fake password forms and malware, instead using polished product pages and genuine Google OAuth sign-in screens to appear legitimate before pushing paid subscriptions from under $10/month to over $2,000/year. Google's consent screens revealed developer contacts using free webmail addresses unconnected to the displayed brands; researchers advise verifying URLs and consent-screen developer details before paying.
- 100+ sites from one $249 toolkit, likely a single operator, sell fake AI subscriptions
- Genuine Google sign-in lends false legitimacy; no fake password forms or malware used
- Some sites collect uploaded documents or recordings before any product trial exists
- Prices range from under $10/month to over $2,000/year with no verifiable operator details
- ATT&CK
- T1656 Impersonation
- Organizations
- MalwarebytesGoogle
From the original article
3 min read at helpnetsecurity.com
Scammers are using a $249 website toolkit to sell unverified AI subscriptions worth up to $2,000 a year, and a genuine Google sign-in screen is what makes the sites convincing. Malwarebytes found more than 100 websites built this way, all tied to the same toolkit and closely related developer details.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.