More than 100 look-alike subscription sites use genuine Google sign-in, with prices from under $10/month to over $2,000/year
Malwarebytes found no malware and no fake login form across the network, so the sites pass every check a user is trained to run, and the companies selling the annual plans stay anonymous.
The Watch · Security desk
What happened
- Malwarebytes found more than 100 subscription sites it links through one toolkit and closely related developer details, and says a single operator or closely connected group is behind them.
- Some sites imitate existing products including GPT-6 Astra, DaVinci Resolve, PixAI and OpenCut, and one trades on the name of Omegle, the chat service that shut down in 2023.
- Malwarebytes found polished product pages and genuine Google sign-in screens leading to paid plans, and the sites it examined came back clean: no fake password forms, no malware downloads.
- Plans run from less than $10 a month to more than $2,000 a year, and on the sites examined signing in produced a pricing page instead of the tool, so payment came before any test of the product.
- The sites run on the same commercial website starter kit, a legitimate product whose vendor advertises that a customer can launch a product in an hour.
Why it matters
- What it limits constraint The two checks awareness training leans on, the padlock and the domain of the login page, both come back clean here, so the only remaining test is whether the buyer can establish who is taking the money.
- What it costs cost A chargeback is the buyer's one route to a refund, because billing runs through the kit's built-in component and the company named on the page is unverifiable.
- Who's exposed exposure Buyers hand over more than the subscription fee: several sites ask for documents, recordings and other files, and those go to an operator Malwarebytes was unable to name.
- What it sets up precedent Take down the domains one at a time and the operator's cost stays where it is, since the kit is already paid for and the next brand needs only a fresh domain, design and product description.
Next story · Security · Sep 23
Fake Claude Max giveaway harvests Google logins through a window it draws itselfConfirmed2 publishers
The kit behind all of them is a legitimate commercial product. It includes an account system, billing, file storage and administrative tools, and the buyer supplies the branding and the product being advertised [15]. That is why sites selling voice-cloning tools, video editors, study apps and general-purpose assistants have identical checkout pages and identical account settings [14][16].
Some of them never had the demonstration content cleared out. Several still show the kit's own brand name, its promotional banners, generic menu entries and testimonials from named people and companies with no apparent connection to the service on sale [18]. One had relabelled the kit's sample list of businesses as its own customers. On another, the word "boilerplate" was still in the name of a paid subscription plan [19].
Site owners supply their own figures. One site claimed more than 12 million users [7]. Another displayed the names of well-known companies as customers, and Malwarebytes found no evidence that those businesses were connected to it [8]. Ratings, customer counts, testimonials, test results: the site owner types them onto the page [9].
The kit costs $249 as a one-time purchase, and extra templates run about $2 each [17]. A hundred templates at that price is $200, so the software behind the whole network costs roughly $449 [23]. One annual subscription at the top of the advertised range pays for that more than four times over [24]. Malwarebytes gave the kit's price and its vendor's marketing claim but kept both names out of it [22].
The checks a user is taught to run all pass. The padlock certifies that traffic between the browser and the site is encrypted, and ownership is a separate question it never answers [6]. Because the password goes into Google's own page at a Google address, a user watching for a spoofed login domain is looking at the genuine one [20]. The links between the brands are visible only to someone comparing the sites: identical underlying files and closely related developer email addresses [5].
Many legitimate services charge before use, and Malwarebytes locates the problem in the seller: who takes the payment stays unknown, and the page's claims have nothing independent to check them against [13].
What to watch
- Whether Google acts against the sign-in integrations, the one step that would affect all 100-plus domains at once.
- Whether the starter kit and its vendor are identified, and whether the vendor's terms bar this use.
- Whether any buyer reports paying for a product that never appeared, which is what a fraud case would need.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Malwarebytes found more than 100 subscription websites linked through the same toolkit and closely related developer details.
- [2]
Some of the sites impersonate existing products, including GPT-6 Astra, DaVinci Resolve, PixAI and OpenCut.
- [3]
Another site uses the name of Omegle, the chat service that shut down in 2023.
- [4]
The sites Malwarebytes examined did not use fake password forms or push malware downloads; they used polished product pages and genuine Google sign-in screens before directing visitors to paid plans.
- [5]
Despite different names and designs, the sites share identical underlying files and closely related developer email addresses, which Malwarebytes says suggests a single operator or closely connected group is behind the network.
- [6]
The secure connection and padlock only show that traffic between the visitor and the site is encrypted; they do not confirm who operates the site.
- [7]
One site claimed to have more than 12 million users.
- [8]
Another site displayed the names of well-known companies as customers, and Malwarebytes found no evidence that those businesses were connected to it.
- [9]
A website owner can add any rating, customer number, testimonial or test result to a page, so none of these claims is independent evidence that a product is genuine or widely used.
- [10]
Behind the sign-in button, visitors are shown paid plans, usage credits and payment histories, with prices ranging from less than $10 a month to more than $2,000 a year.
- [11]
Several sites ask users to upload documents, recordings or other files for the advertised service to process.
- [12]
On the sites examined there was no way to test the advertised product before paying: landing page controls did nothing until sign-in, and signing in led to a pricing page rather than the tool.
- [13]
Malwarebytes says the concern is the lack of reliable information about the company selling the subscription, with no independent reviews or official product listings to compare with the claims on the page.
- [14]
The sites advertise voice-cloning tools, video editors, study apps and general-purpose AI assistants, and underneath their different designs they use the same commercial website starter kit.
- [15]
The starter kit is a legitimate product designed to help people launch online services quickly; it includes an account system, billing, file storage and administrative tools, and the buyer supplies the branding and the product being advertised.
- [16]
Because the underlying system is the same, apparently unrelated services have identical checkout pages and account settings even when colours, typefaces and product names differ.
- [17]
The kit costs $249 as a one-time purchase, additional templates cost about $2 each, and its vendor advertises that customers can launch a product in an hour.
- [18]
Several sites still contain demonstration material supplied with the starter kit, including the kit's brand name, promotional banners, generic menu entries, and testimonials from named people and companies with no apparent connection to the advertised service.
- [19]
One site had relabelled a demonstration list of businesses as its own customers, and on another the word "boilerplate" remained in the name of a paid subscription plan.
- [20]
The sites send visitors to a genuine Google sign-in page: the web address belongs to Google and the password is entered on Google's website rather than on the service being signed up for.
- [21]
Once the first site exists, building another may require little more than a new domain, design and product description, which Malwarebytes says might explain how the network grew to this scale.
- [22]
The Malwarebytes write-up gives the starter kit's price, template price and the vendor's one-hour launch claim without naming the kit or its vendor.
- [23]
Templates for 100 sites at about $2 each come to about $200, so the kit plus templates for a network of that size costs roughly $449.
- [24]
A single annual subscription at the top of the advertised range, more than $2,000, covers the roughly $449 software cost more than four times over.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comScammers use genuine Google sign-ins to sell costly, unverified AI subscriptions
1 article · September 22, 2026
- malwarebytes.comThe fake sites using a cheap toolkit to sell $2,000 AI subscriptions
1 article · September 21, 2026
Topics and entities
Topics
- Brand Impersonation
- Subscription Scams
- SaaS starter kits
- Sign in with Google and OAuth consent