Case gtig-coinbait-lovable-phishAI phishingWorldwide
COINBAIT crypto-exchange phishing kit built with Lovable AI app builder
GTIG found COINBAIT, a React single-page phishing kit imitating a crypto exchange, attributed to financially motivated cluster UNC5356, with Supabase and lovable.app artefacts showing Lovable AI-built code.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 12, 2026
- Location
- Worldwide
- Target
- Cryptocurrency exchange customers
- Severity
- Medium
- Triggered by
- UNC5356
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
GTIG found COINBAIT, a React single-page phishing kit imitating a crypto exchange, attributed to financially motivated cluster UNC5356, with Supabase and lovable.app artefacts showing Lovable AI-built code.
Impact: Credential harvesting kit in circulation; victims not quantified.
Who triggered it
Actor: UNC5356
Attribution: GTIG attributes the kit to UNC5356 and assesses Lovable-based development from code artefacts.
Motive: Credential theft and crypto fraud
How it happened
Attack vector: AI-generated phishing site harvesting exchange logins
Root cause: No-code AI app builders lower the cost of convincing phishing front-ends
Timeline
- COINBAIT kit observed in UNC5356 crypto phishing
- GTIG publishes the kit in its AI Threat Tracker
Response
Google documented indicators such as Analytics-prefixed log messages for defenders.
Current status: Ongoing
Sources (open in a new tab)
- BleepingComputer on GTIG February 2026 report bleepingcomputer.com
- HackMag coverage hackmag.com
- Decryption Digest analysis decryptiondigest.com
Cite this case
COINBAIT crypto-exchange phishing kit built with Lovable AI app builder. AI Threat Watch, case gtig-coinbait-lovable-phish, Feb 12, 2026. https://aithreat.io/cases/gtig-coinbait-lovable-phish/
Permanent link: https://aithreat.io/cases/gtig-coinbait-lovable-phish/