Malwarebytes warns fake AI subscription sites could put enterprise data at risk

Malwarebytes said the fake sites do not host malware or fake password forms, but they collect credentials and potentially sensitive files. The researchers suspect a single actor or group runs all the sites, noting they were built with the same commercial website‑creation kit that costs a one‑time purchase plus about $2 per additional template. The kit provides account management, billing and file storage functions. Because the sites appear legitimate, enterprises may purchase them through shadow IT, exposing corporate data to an unknown destination.

The firm advises users to verify the operator of any AI service, check developer details shown during Google authentication, and avoid uploading sensitive data to unverified services. It also recommends reviewing and revoking unwanted Google app connections.