100+ fake AI subscription sites built from a $249 toolkit use genuine Google sign-ins to sell plans up to $2,000/year

Malwarebytes uncovered more than 100 fake AI subscription websites built from a $249 commercial toolkit, likely run by a single operator, that use genuine Google OAuth sign-ins instead of malware to appear legitimate before charging subscriptions from under…

Malwarebytes identified more than 100 subscription websites impersonating or inventing AI products — including GPT-6 Astra, DaVinci Resolve, PixAI, OpenCut, and the defunct Omegle — all built from a $249 commercial starter kit. Closely related developer email addresses and shared site-kit files suggest a single operator. The sites deploy no malware and no fake password forms; instead they rely on polished product pages and genuine Google OAuth sign-in screens to appear legitimate, obtaining the visitor's name, email, and profile details without requesting Gmail or Drive scopes. Google's consent screens listed developer contacts using free webmail addresses unconnected to the displayed brands. Subscriptions are priced from under $10/month to over $2,000/year with no verifiable operator details, and some sites ask visitors to upload documents or recordings before any product trial exists. Researchers advise verifying URLs and consent-screen developer details before paying.

• Malwarebytes found more than 100 fake AI subscription websites, first reported 2026-09-21
• All sites were built from a $249 commercial starter kit; shared site-kit files and closely related developer emails suggest a single operator
• Impersonated or invented products include GPT-6 Astra, DaVinci Resolve, PixAI, OpenCut, and defunct services such as Omegle
• Sites use genuine Google OAuth sign-in to collect name, email, and profile details; Gmail and Drive scopes were not requested
• No malware and no fake password forms were observed on the examined sites
• Subscription prices range from under $10/month to over $2,000/year with no verifiable operator details
• Some sites request uploads of documents or recordings before any product trial exists
• Google consent screens showed developer contacts using free webmail addresses unconnected to the displayed brands