Beware Fake Websites Selling AI Assistants: A Growing Threat to Enterprise Data

Bogus websites offering subscriptions to popular artificial intelligence (AI) tools and services are on the rise, putting enterprise data at risk. According to researchers at Malwarebytes, over 100 fake sites have been identified impersonating reputable AI products such as GPT-6 Astra, DaVinci Resolve, PixAI, and OpenCut. These websites use legitimate Google sign-in processes to gain credibility and trick users into paying for access to the promised services.

The fake websites are polished and convincing, incorporating genuine Google authentication elements that invite users to ‘Sign in with Google’ to enhance their experience. However, once users enter their credentials on Google’s website, they are asked to provide basic information such as name, email address, and profile picture. The sites do not request access to Gmail or Google Drive, but some ask users to upload documents, recordings, or other files to unlock the advertised services.

The danger for enterprises lies in the fact that would-be customers of these fake services may think they are getting a good deal for their departmental budget and choose to bypass IT involvement. Shadow IT is already a concern when it comes to legitimate products, but with fake services, there’s no knowing where the data gathered will end up.

Malwarebytes’ researchers suspect that all the fake subscription sites identified are run by the same person or group, as they were created using the same website creation kit based on identical underlying files and closely related developer email addresses. The website creation kit is a legitimate commercial offering that provides account management, billing, file storage, and other administrative functions.

The researchers noted that the makers of the website creation kit claim it can launch a website in an hour and offer additional templates for about $2 each after a one-time purchase. However, the fake sites use genuine Google sign-in pages rather than fake password forms to gain credibility. Visitors enter their credentials on Google’s website, and the applications request basic information such as name, email address, and profile picture.

Google’s consent screen generally identifies the application requesting access and provides developer details. However, on the fake websites, that screen displayed free webmail addresses for the developer contacts instead of addresses belonging to the well-known AI services promised. In some cases, the unfamiliar AI brands provided little independently verifiable information about the businesses selling the subscriptions.

Malwarebytes recommends that users look beyond a site’s design and familiar authentication options when deciding whether an AI service is legitimate. This includes checking who operates the service, looking for verifiable company information, and examining developer details shown during Google authentication. The researchers also warned against uploading sensitive documents or recordings to unfamiliar AI services, particularly if the business behind the site cannot be independently verified.

For users connected through Google, it’s possible to review connections in their Google Account and remove services they no longer trust or recognize to prevent future access. By being cautious and doing some due diligence, individuals can avoid falling victim to these fake websites offering AI assistants.