Case proofpoint-lovable-phishingAI phishingWorldwide
Proofpoint: Lovable AI builder abused for Tycoon MFA phishing hitting 5,000+ organisations
Proofpoint saw tens of thousands of malicious Lovable URLs a month since February 2025; one Tycoon campaign hit over 5,000 organisations with AI-built fake Microsoft logins capturing MFA tokens and session cookies.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 20, 2025
- Location
- Worldwide
- Target
- Microsoft 365 users, UPS customers, Aave wallet holders
- Severity
- High
- Triggered by
- Multiple criminal groups incl. Tycoon kit operators
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Proofpoint saw tens of thousands of malicious Lovable URLs a month since February 2025; one Tycoon campaign hit over 5,000 organisations with AI-built fake Microsoft logins capturing MFA tokens and session cookies.
Impact: Over 5,000 organisations hit in one campaign; payment card and SMS code data posted to Telegram; zgRAT delivered via a German invoice lure.
Who triggered it
Actor: Multiple criminal groups incl. Tycoon kit operators
Attribution: Proofpoint telemetry; Lovable matched the reports to a cluster its Trust and Safety team had already found.
Motive: Credential theft, card fraud and crypto wallet draining
How it happened
Attack vector: Prompt-generated phishing pages hosted on lovable.app, math CAPTCHA gates, adversary-in-the-middle Microsoft login clones, remixable harvester templates
Root cause: The AI builder generated and hosted deceptive credential pages without technical or policy barriers
Timeline
- Tycoon file-sharing lure campaign impacts over 5,000 organisations
- UPS impersonation (3,500 messages) and Aave drainer (10,000 emails) campaigns
- Lovable adds real-time detection and daily scans of published projects
- Proofpoint publishes research
Response
Lovable removed hundreds of phishing domains and the UPS app, added prompt-time blocking and daily scanning, and planned account-level fraud controls.
Current status: Contained
Sources (open in a new tab)
- Proofpoint proofpoint.com
- TechRadar techradar.com
Cite this case
Proofpoint: Lovable AI builder abused for Tycoon MFA phishing hitting 5,000+ organisations. AI Threat Watch, case proofpoint-lovable-phishing, Aug 20, 2025. https://aithreat.io/cases/proofpoint-lovable-phishing/
Permanent link: https://aithreat.io/cases/proofpoint-lovable-phishing/