A website calling itself GPT-6 Astra will sell you its top plan for $249 a month. The commercial starter kit that sites like it are built on costs $249 once, and you keep it.
Researchers at Malwarebytes have mapped more than 100 subscription websites linked through the same toolkit and closely related developer details, and published the original report on 21 September. Some borrow the names of real products, including GPT-6 Astra, the video editor DaVinci Resolve, the anime generator PixAI and the editor OpenCut. Another uses the name of Omegle, the chat service that shut down in 2023. The rest push brands nobody has heard of, with little verifiable information about who operates them.
None of them faked a password box or pushed malware. They took payment instead.
Twelve million users, allegedly
One site claimed more than 12 million users. Another displayed well-known companies as customers, and Malwarebytes found no evidence those businesses were connected to it. Ratings, testimonials and user counts are things a site owner types into a page. The padlock only confirms the traffic is encrypted, not who is on the other end. Behind the claims the team found no registered company names, business addresses or other verifiable ownership details, and often the only contact was an email address on the site's own domain. Prices run from under $10 a month to more than $2,000 a year, and on the sites examined there was no way to try the product before paying.
One kit, a hundred shopfronts
These sites load code files whose names are derived from their contents, so identical filenames across unrelated brands mean identical software underneath. The kit is a legitimate product, sold for $249 as a one-time purchase, and its vendor advertises that a customer can launch in an hour. Several buyers never finished the job. The sites still carry the kit's own brand name, generic menu entries and testimonials from people with no apparent connection to the service. One had relabelled a demonstration list of businesses as its own customers. On another, the word "boilerplate" was still sitting in the name of a paid plan.
A real Google login proves nothing
Visitors are sent to a genuine Google sign-in page, and the password is typed on Google's site rather than the seller's. The sites asked only for a name, email address and profile picture, not for access to Gmail or Drive. That is the trap. The login is real, and it tells you nothing about who owns the application behind it. Google's consent screen names that application and shows its developer details, and here those support contacts were free webmail addresses rather than anything belonging to the brands on display. Those addresses shared the same name with only small differences such as appended numbers. Because they are supplied when an app is registered with Google rather than by the kit, they point to one party, or a closely connected group, behind the network.
Read the consent screen before you pay
Check that the web address belongs to the product you meant to buy, not just the logo, and look for ownership details you can verify elsewhere. Read the application name, domain and developer details on Google's consent screen before selecting Continue. Do not upload documents, recordings or photos to a service whose operator you cannot name. If you have already subscribed, watch your card statements and remove the app from the connections page of your Google Account.
The economics are the uncomfortable part. Once the first shopfront exists, the next needs little more than a domain, a fresh colour scheme and a product description. We have seen the same turnkey pattern in crypto scam kits sold for a few hundred dollars, and AI branding is proving as easy to borrow as a browser extension's name.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.