# Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections

- Severity: Medium · Status: Partly contained (past)
- Chains: Multiple EVM chains · Method: Fake airdrop, claim and mint sites
- Started: Jun 17, 2025 · Last update: Aug 20, 2025
- Who/what: Aave and other DeFi users receiving fake reward emails
- AI involvement: AI-made lures. Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app.

Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.

## Am I affected?
If you clicked an 'Aave reward' email in mid-2025 and connected a wallet or signed anything on the page it opened, check your wallet's token approvals and recent transactions.

## What to do now
- Revoke unknown token approvals with a trusted tool such as revoke.cash, opened from your own bookmark.
- If anything was signed or moved, send the rest of your funds to a new wallet.

## How to avoid this
- Open DeFi apps only from your own bookmark, never from an email link.
- Real protocols do not email you rewards to claim; AI tools now make convincing copies of any site in minutes.
- Read every wallet prompt and reject any approval or signature you did not expect.

## Indicators (block these, never visit them)
- Domain: aave-reward-notification.lovable[.]app
- Domain: reward-aave[.]us

## Sources
- Cybercriminals Abuse AI Website Creation App for Phishing (Proofpoint, 2025-08-20): https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing

Full record: https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025 · JSON: https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.