{
 "slug": "lovable-ai-built-aave-phishing-sites-jun-2025",
 "title": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
 "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025",
 "json": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "ai": {
  "role": "ai-lure",
  "note": "Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app."
 },
 "chains": [
  "multi-evm"
 ],
 "method": "fake-airdrop-site",
 "product": "Aave and other DeFi users receiving fake reward emails",
 "tags": [
  "multi-evm",
  "fake-airdrop-site",
  "aave",
  "lovable",
  "ai-website-builder",
  "email-phishing",
  "sendgrid",
  "wallet-connect",
  "proofpoint",
  "drainer",
  "ai"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2025-06-17",
 "closedAt": "2025-08-20",
 "updatedAt": "2025-08-20T12:00:00Z",
 "summary": "Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.",
 "timeline": [
  {
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing"
  },
  {
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "Cybercriminals Abuse AI Website Creation App for Phishing",
   "url": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "publisher": "Proofpoint",
   "date": "2025-08-20"
  }
 ],
 "indicators": {
  "domains": [
   "aave-reward-notification.lovable[.]app",
   "reward-aave[.]us"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you clicked an 'Aave reward' email in mid-2025 and connected a wallet or signed anything on the page it opened, check your wallet's token approvals and recent transactions.\n\n## What to do now\n- Revoke unknown token approvals with a trusted tool such as revoke.cash, opened from your own bookmark.\n- If anything was signed or moved, send the rest of your funds to a new wallet.\n\n## How to avoid this\n- Open DeFi apps only from your own bookmark, never from an email link.\n- Real protocols do not email you rewards to claim; AI tools now make convincing copies of any site in minutes.\n- Read every wallet prompt and reject any approval or signature you did not expect.",
 "notes": null,
 "agentBrief": "# Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections\n\n- Severity: Medium · Status: Partly contained (past)\n- Chains: Multiple EVM chains · Method: Fake airdrop, claim and mint sites\n- Started: Jun 17, 2025 · Last update: Aug 20, 2025\n- Who/what: Aave and other DeFi users receiving fake reward emails\n- AI involvement: AI-made lures. Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app.\n\nProofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.\n\n## Am I affected?\nIf you clicked an 'Aave reward' email in mid-2025 and connected a wallet or signed anything on the page it opened, check your wallet's token approvals and recent transactions.\n\n## What to do now\n- Revoke unknown token approvals with a trusted tool such as revoke.cash, opened from your own bookmark.\n- If anything was signed or moved, send the rest of your funds to a new wallet.\n\n## How to avoid this\n- Open DeFi apps only from your own bookmark, never from an email link.\n- Real protocols do not email you rewards to claim; AI tools now make convincing copies of any site in minutes.\n- Read every wallet prompt and reject any approval or signature you did not expect.\n\n## Indicators (block these, never visit them)\n- Domain: aave-reward-notification.lovable[.]app\n- Domain: reward-aave[.]us\n\n## Sources\n- Cybercriminals Abuse AI Website Creation App for Phishing (Proofpoint, 2025-08-20): https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing\n\nFull record: https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025 · JSON: https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}