Subscribe
, ,

How to spot fake AI apps and sites that steal your passwords

AIooze Editorial

In one minute

  • What you will be able to do: tell a real AI app or website from a fake one built to steal your passwords.
  • What you need: the computer or phone you use for AI tools.
  • How long it takes: 15 minutes to read and check your setup.

Why this is worth doing

Criminals follow whatever people are excited about, and right now that is AI. A popular trick is a “free” AI photo, video or chatbot tool that hands you a file which is really an infostealer: malware that quietly copies the passwords, browser cookies and payment details saved on your device.

In 2025 the security firm Morphisec found fake “free image-to-video AI” sites promoted through Facebook groups. People uploaded a photo, were told their video was ready, and downloaded a zip file that contained malware instead. One promotional post drew more than 62,000 views. New Zealand’s National Cyber Security Centre says infostealers “silently steal passwords, browser cookies, banking credentials, cryptocurrency-wallet data, and authentication tokens”.

The good news: a few habits stop most of these traps before anything is installed.

The steps

  1. Get AI tools only from the maker. Type the maker’s web address yourself, or use your phone’s official app store. The US Federal Trade Commission warns that scammers run “bogus ads for software on social media sites and on search engines”, so skip the ads and sponsored links.
  2. Treat “free” AI offers in groups and ads with suspicion. A real AI tool from a known company rarely needs a Facebook group, a Telegram channel or a stranger’s link to reach you.
  3. Check what you are downloading. An AI picture or video should arrive as a picture or video. If a website gives you a zip file or a program to “see your result”, stop and delete it unopened. Turning on file name extensions in your computer’s file manager helps you spot a file like “video.mp4.exe” (Microsoft’s support site explains how for your version of Windows).
  4. Never paste a command a website asks you to run. Microsoft describes a trick it calls ClickFix: a fake “verify you are human” box quietly copies a command, then asks you to paste and run it in the Run box, Terminal or PowerShell. Microsoft says the most common result is password-stealing malware. A real check never asks you to do this.
  5. Check the publisher before installing an app or browser add-on. Fake apps copy famous AI names. Make sure the developer listed is the real company, and look up the official app through the maker’s own website if unsure.
  6. Keep your device, browser and apps updated. The UK NCSC says updates “contain vital security updates to help protect your devices from cyber criminals”. Turn on automatic updates.
  7. Make stolen passwords less useful. Use a password manager so every account has its own password, and turn on two-step verification, starting with email and banking. CISA says that even if your password is stolen, attackers still cannot get past the second step.
  8. If you think you ran something fake, act from a clean device. New Zealand’s Own Your Online advice: get help if unsure, update and scan the device (or reset it as a last resort), then change passwords, reset two-step verification and “sign out of all devices” so stolen sessions stop working. Our malware guide walks through the account steps.

A worked example (illustrative)

Meena sees a post in a hobby group: “Turn any photo into a moving video, free with AI!” She uploads a picture of her dog. The site says “Your video is ready” and downloads “DogVideo.zip”.

Step 3 stops her: a video should not arrive as a zip. She deletes the file without opening it, then finds the AI video tool she had heard of through its maker’s real website instead.

Had she opened the file, step 8 applies: stop using that computer for logins, get it scanned or reset, then change her passwords from her phone and sign out of every other session.

Watch out for

  • Macs and phones are not immune. Microsoft has reported ClickFix campaigns that use fake macOS utilities to deliver infostealers.
  • Changing a password on an infected device can hand over the new one. Clean the device first, or use another one.
  • Cookies matter as much as passwords. Stolen login cookies can let criminals in without your password, which is why signing out of all sessions is part of the fix.
  • Never call a number in a pop-up that says your computer is infected. The FTC says these are scams.

Go deeper

Sources

Related