The fake sites using a cheap toolkit to sell $2,000 AI subscriptions

This is a classic example of low-effort, high-volume fraud scaling. A threat actor is using a $249 commercial toolkit to spin up over 100 fake domains, cloning legitimate AI product pages (and some less-known brands) to push $2,000 subscription scams.

Technical Breakdown: – TTPs (MITRE): Resource Development (T1583.001 – Domains), User Execution (T1204), Phishing (T1566.002 – Spearphishing Link). – Tooling: A cheap, commercially available "AI subscription scam kit" for $249. This lowers the barrier to entry significantly. – Infrastructure: 100+ linked domains, likely using a shared hosting provider or a bulletproof registrar. The sites are copies of legitimate product pages. – IOCs: Not provided in the summary, but the article likely lists specific domains. The key IOC pattern is the use of the same $249 toolkit across all sites, suggesting identical HTML structure or JS fingerprints. – Target: Users searching for popular AI tools (ChatGPT, Midjourney, etc.) and lesser-known AI brands.

Defense: – User Education: Warn users to only download AI software from the official app store or the vendor's verified domain. Check for HTTPS and look for typos in the URL. – Detection: Monitor for domains registered recently that mimic known AI brand names. Block known domains from the article's IOC list. Deploy browser extension that flags lookalike domains.

Source: https://www.malwarebytes.com/blog/threat-intel/2026/09/the-fake-sites-using-a-cheap-toolkit-to-sell-2000-ai-subscriptions