← Back to feed
Threat Actors & CampaignsEmerging1 sourceSep 21, 2026 · 15:38via Malwarebytes Labs

The fake sites using a cheap toolkit to sell $2,000 AI subscriptions

Brief

We found more than 100 subscription websites linked through the same toolkit and closely related developer details. Some impersonate existing products, including GPT-6 Astra, DaVinci Resolve, PixAI, and OpenCut. Another uses the name of Omegle, the chat service that shut down in 2023. Others promote unfamiliar brands with little verifiable information about who operates them.

The sites we examined did not use fake password forms or push malware downloads. Instead, they used polished product pages and genuine Google sign-in screens before directing visitors to paid plans. Someone visiting an imitation site could believe they were buying from the genuine provider.

With the unfamiliar brands, it is difficult to establish who is selling the subscription or independently verify the claims being made.

Read more on Malwarebytes Labs