{"id":9554,"date":"2026-09-22T13:11:29","date_gmt":"2026-09-22T13:11:29","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9554"},"modified":"2026-09-22T13:11:29","modified_gmt":"2026-09-22T13:11:29","slug":"beware-these-fake-websites-selling-subscriptions-to-ai-assistants","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9554","title":{"rendered":"Beware these fake websites selling subscriptions to AI assistants"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Websites offering fake subscriptions to AI transcription tools, image generators, and other digital assistants could be putting enterprise data at risk, according to researchers at Malwarebytes.<\/p>\n

The sites impersonate AI products with solid reputations, including GPT-6 Astra<\/a>, DaVinci Resolve<\/a>, PixAI<\/a> and OpenCut<\/a>, in addition to some that no longer exist (such as Omegle, a chat service shut down<\/a> in 2023) or are less reputable.<\/p>\n

All the fake websites were polished and incorporate genuine Google authentication elements inviting users to \u201cSign in with Google\u201d to enhance credibility on the path to charging visitors\u2019 payment cards anything from $10 a month to as much as $2,000 for a year\u2019s access to the promised AI and software services.<\/p>\n

\u201cThe sites we examined did not use fake password forms or push malware downloads,\u201d Malwarebytes researchers said in a blog post describing their discovery<\/a>. But some of the sites asked users to upload documents, recordings, or other files in order to unlock the advertised services.<\/p>\n

The danger for enterprises is if would-be customers of such services think they\u2019re getting a good deal for their departmental budget and don\u2019t want to involve IT in the buying process. Shadow IT is bad enough when the products are legitimate, but in these cases there\u2019s no knowing where the data gathered will end up.<\/p>\n

<\/a>Malwarebytes\u2019 researchers suspect that all the fake subscription sites it identified are run by the same person or group, since they were all created using the same website creation kit based on identical underlying files and with closely related developer email addresses shared across them.<\/p>\n

The website creation kit is a legitimate commercial offering that provides account management, billing, file storage and other administrative functions, Malwarebytes said, noting its makers claim it can launch a website in an hour and that, after a one-time purchase, additional templates cost only about $2 each.<\/p>\n

The fake sites use genuine Google sign-in pages rather than fake password forms. Visitors enter their credentials on Google\u2019s website and the applications request basic information such as their name, email address and profile picture. Malwarebytes said the sites it examined did not request access to Gmail or Google Drive.<\/p>\n

Google\u2019s consent screen generally identifies the application requesting access and provides developer details, Malwarebytes noted. But on the fake websites, that screen displayed free webmail addresses for the developer contacts instead of addresses belonging to the well-known AI services promised. In the case of the unfamiliar AI brands, the sites provide little independently verifiable information about the businesses selling the subscriptions, the researchers added.<\/p>\n

<\/a>Look past the polish<\/h2>\n

Malwarebytes recommends that users look beyond a site\u2019s design and the presence of familiar authentication options when deciding whether an AI service is legitimate. These include checking who operates the service, looking for verifiable company information and examining the developer details shown during Google authentication.<\/p>\n

It also warned users not to upload sensitive documents<\/a>, recordings or other data to unfamiliar AI services, particularly when the business behind the site cannot be independently verified.<\/p>\n

For services connected through Google, users can review the connections in their Google Account and remove services they no longer trust or recognize to prevent future access.<\/p>\n

This article first appeared on <\/em>Computerworld<\/a>.<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Websites offering fake subscriptions to AI transcription tools, image generators, and other digital assistants could be putting enterprise data at risk, according to researchers at Malwarebytes. The sites impersonate AI products with solid reputations, including GPT-6 Astra, DaVinci Resolve, PixAI and OpenCut, in addition to some that no longer exist (such as Omegle, a chat […]<\/p>\n","protected":false},"author":0,"featured_media":9555,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9554","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9554"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9554"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9554\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9555"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}