Anonymous AI Halloween video sites built from $249 kit solicit personal photos with no identifiable operator
Malwarebytes researchers examined AI Halloween video sites that ask users to upload photos of themselves, partners, pets and children, and found no malware or phishing. The concern is that the sites show no company name, address or named operator, only a support email on the site's own domain. They appear to be built from the same $249 website kit behind 100+ subscription sites Malwarebytes reported in September. Uploads are passed to unnamed outside AI providers, and deletion promises could not be independently verified.
Detalhes técnicos
- Sites use real Google sign-in, but the developer info listed only a Gmail address on one site. Another showed the sign-in as going to neon.tech, a legitimate authentication/database provider that does not operate or endorse the site.
- One site still held the template's sample content, a "demo site" note and placeholder links such as "your-app-name". Another's code held remnants of an AI rap and dance video maker.
- Pricing and pressure tactics: a 15-second clip cost $9.99, a $199 pack gave about 66 videos, and plans reached $600 a year. Countdown timers, browser-tab reminders and claims about daily usage nudged purchases. Credits can expire and subscriptions auto-renew.
- Risks cited: likeness misuse for fake intimate images and extortion. In the Malwarebytes Face Value report, 10% of respondents said someone threatened to release AI-generated explicit content of them. No evidence of this via these sites was found.
Remediação
- Identify a named operator and contact details before uploading.
- Read the privacy policy for outside AI providers, retention, AI training use and the deletion process.
- Be cautious with children's photos, and upload others' photos only with their permission.
- Check the developer details in Google's sign-in window.
- Ignore countdowns and review payment terms, credit expiry and renewal.
- Afterward, remove unused services from your Google account's third-party connections. This does not delete data already held.
Linha do tempo
-
Anonymous AI Halloween video sites built from $249 kit solicit personal photos with no identifiable operator
ler a análise desta fonte ocultar
Malwarebytes researchers examined AI Halloween video sites that ask users to upload photos of themselves, partners, pets and children, and found no malware or phishing. The concern is that the sites show no company name, address or named operator, only a support email on the site's own domain. They appear to be built from the same $249 website kit behind 100+ subscription sites Malwarebytes reported in September. Uploads are passed to unnamed outside AI providers, and deletion promises could not be independently verified.
Technical Details
- Sites use real Google sign-in, but the developer info listed only a Gmail address on one site. Another showed the sign-in as going to neon.tech, a legitimate authentication/database provider that does not operate or endorse the site.
- One site still held the template's sample content, a "demo site" note and placeholder links such as "your-app-name". Another's code held remnants of an AI rap and dance video maker.
- Pricing and pressure tactics: a 15-second clip cost $9.99, a $199 pack gave about 66 videos, and plans reached $600 a year. Countdown timers, browser-tab reminders and claims about daily usage nudged purchases. Credits can expire and subscriptions auto-renew.
- Risks cited: likeness misuse for fake intimate images and extortion. In the Malwarebytes Face Value report, 10% of respondents said someone threatened to release AI-generated explicit content of them. No evidence of this via these sites was found.
Remediation
- Identify a named operator and contact details before uploading.
- Read the privacy policy for outside AI providers, retention, AI training use and the deletion process.
- Be cautious with children's photos, and upload others' photos only with their permission.
- Check the developer details in Google's sign-in window.
- Ignore countdowns and review payment terms, credit expiry and renewal.
- Afterward, remove unused services from your Google account's third-party connections. This does not delete data already held.