Source: www.proofpoint.com – Author:
Cybercriminals are using AI website builders to spin up websites for credential phishing.
Threat researchers at Proofpoint observed hackers using Lovable to create websites that impersonated well-known brands, used CAPTCHA to deter bots, and delivered stolen credentials to Telegram.
Lovable is a popular AI-company that can let users build any website or application they want using natural language prompts. The company raised $200m and was valued at $1.8b in July, just 8 months after launch.
In a report shared with Expert Insights, Proofpoint’s Threat Research Team revealed they have seen ‘tens of thousands’ of Loveable URLs in email messages since February 2025.
There’s been a lot of discussion in the cybersecurity space about the practice of ‘vibe coding,’ or using AI powered tools to generate websites and applications.
Many experts have warned about the potential vulnerabilities that can arise when non-technical users build apps using AI with no guardrails.
But this new campaign highlights the potential ways hackers can use AI tools to enable them to accelerate their campaigns and push out new attacks faster and more cost-effectively.
“Our latest research shows that AI-powered website builders are drastically lowering the barrier for cybercriminals to launch phishing, fraud, and malware campaigns,” Cristiana Kittner, threat researcher at Proofpoint told Expert Insights.
“These tools allow threat actors to scale more quickly and convincingly than ever before. To effectively combat this growing trend, network defenders must proactively stay ahead of innovations to best anticipate these sophisticated and growing threats.”
“The democratization of these attack capabilities has resulted in a shift in how security leaders need to address enterprise defenses and user security and vigilance.”
How The Attack Works
Proofpoint’s researchers detected ‘multiple’ campaigns using Lovable services to create malicious apps. This includes MFA phishing kits, cryptocurrency wallet drainers or malware loaders and phishing kits targeting credit cards and personal information.
One attack Proofpoint observed involved a phishing campaign impersonating Microsoft SharePoint. The attack targeted over 5,000 organizations.
First, a user would receive an email that looks like this:
They would then be taken to a web page built in Lovable, requesting the user verifies they are real:
Finally, the user would be directed to a final phishing page branded as either Microsoft or OKTA where the user would be prompted to share their credentials and MFA codes.
The researchers found a lot of variety in the initial phishing emails used. Some impersonated the target companies HR department, others impersonated well-known brands, like UPS.
In other campaigns, researchers found threat researchers were using the Lovable app to share malware designed to drain Crypto wallets.
In a statement provided to news website Dark Reading, a Lovable spokesperson said:
“Lovable has been investing significant resources into enhancing trust and safety on the platform. As any platform that offers hosting and development capabilities, we are dealing with a certain number of malicious actors that find opportunities to use technology for harming others,” the spokesperson said. “Our message is clear: Lovable will not tolerate illegal or malicious content. We’re committed to making Lovable a safe, trusted space for everyone.”
The Big Picture
This is not the first time AI website and app builders have been used to spin-up phishing websites.
In July, Axios reported hackers were using Vercel Vo, another popular vibe coding app, to build phishing sites impersonating login pages, including Okta.
The best way to protect your users against phishing is to implement robust identity controls, like multi-factor authentication.
It’s also a good idea to consider a robust email security solution, or conducting some phishing training to let users know how to spot suspected scam emails.
Read more on this story:
Original Post URL: https://www.proofpoint.com/us/newsroom/news/hackers-are-vibe-coding-phishing-websites-steal-credentials
Category & Tags: –
Views: 5
