Threat Actors Scale Phishing and Fraud With AI Website Builders and Synthetic Media

Threat actors are using legitimate and open-weight AI tools to expand phishing, malware delivery, reconnaissance, and fraud operations. Proofpoint observed tens of thousands of malicious Lovable AI website-builder URLs per month in email traffic from February 2025, including pages impersonating Microsoft, UPS, banks, and Aave. Campaigns deployed Tycoon AiTM phishing kits, cryptocurrency wallet drainers, and malware chains involving DOILoader and zgRAT; some sites used CAPTCHA filtering and sent harvested data directly to Telegram. Lovable’s free hosting and remixable public projects enabled rapid cloning of malicious templates, though the provider removed at least one phishing cluster and introduced real-time detection and daily scanning in July 2025.

Recorded Future reported that groups including The Gentlemen ransomware operation have used Chinese AI models for payload generation, analysis, and personally identifiable information triage, while the EvilTokens phishing-as-a-service platform combines AI-generated lures, target research, account validation, and customizable infrastructure intended to evade login-time protections. AI-assisted lures have not consistently outperformed conventional phishing, so layered email and authentication defenses remain effective; however, synthetic media creates a more acute identity threat through executive impersonation, high-value fraud, and biometric-injection attacks capable of defeating live identity-verification checks.