PhishingPublished 5 Feb 2026

Researchers Expose Network of 150 Cloned Law Firm Websites in AI-Powered Scam Campaign

Source SecurityWeek

Description

Criminals are using AI to clone professional websites at an industrial scale. A new report shows how one AI-powered network grew to 150+ domains by hiding behind Cloudflare and rotating IP ranges. The post Researchers Expose Network of 150 Cloned Law Firm Websites in AI-Powered Scam Campaign appeared first on SecurityWeek .

Impact

For European organizations, particularly law firms and their clients, this phishing campaign poses a substantial risk to confidentiality and trust. Victims may unknowingly disclose sensitive client data, financial information, or credentials to attackers, leading to identity theft, financial fraud, or reputational damage. The cloned websites can also facilitate further attacks, such as malware distribution or business email compromise, by establishing initial trust. The widespread use of Cloudflare and IP rotation hinders rapid takedown, prolonging exposure. European legal sectors, which handle large volumes of sensitive data and are increasingly targeted by cybercriminals, face heightened risks. Additionally, clients seeking legal services online may be misled, impacting the integrity of legal processes. The campaign could disrupt business operations indirectly through fraud investigations and loss of client confidence. Given the cross-border nature of internet services, the threat affects multiple countries simultaneously, complicating coordinated response efforts.

Defensive guidance

European organizations should implement continuous monitoring for domain impersonation and phishing sites using threat intelligence feeds and domain similarity detection tools. Legal firms must educate employees and clients on verifying website authenticity, emphasizing checking URLs and SSL certificates. Deploy advanced email filtering and web gateway solutions capable of detecting and blocking access to known phishing domains, including those behind Cloudflare. Collaborate with domain registrars and hosting providers to expedite takedown of cloned sites. Employ multi-factor authentication to reduce the impact of credential theft. Regularly update incident response plans to include phishing scenarios involving cloned websites. Encourage reporting of suspicious sites to national cybersecurity authorities and industry groups to facilitate information sharing. Finally, consider leveraging AI-based detection tools to identify anomalous web content and infrastructure patterns indicative of cloning campaigns.

Summary

This threat involves a sophisticated phishing campaign where cybercriminals use artificial intelligence to clone legitimate law firm websites at scale, creating a network of over 150 fraudulent domains. These cloned sites are hosted behind Cloudflare, which provides content delivery and security services, and the attackers rotate IP addresses to avoid detection and takedown efforts. The use of AI enables rapid and convincing replication of professional websites, increasing the likelihood of deceiving victims. The campaign targets users seeking legal services, potentially to harvest sensitive personal or financial information or to facilitate fraud. Although no software vulnerabilities are exploited, the threat leverages social engineering and infrastructure obfuscation techniques. The attackers' use of Cloudflare and IP rotation complicates traditional detection methods, requiring more advanced domain and traffic analysis. The campaign's medium severity rating reflects its significant potential impact on confidentiality and integrity, while availability is less affected. No known exploits in the wild have been reported, but the scale and automation suggest a persistent threat. This campaign highlights the evolving use of AI in cybercrime, emphasizing the need for adaptive defense strategies.

References

securityweek.com/researchers-expose-network-of-150-cloned-law-firm-websites-in-ai-powered-scam-campaign/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Feb 2026, 14:14 UTC

References

Community reviews

Related threats