The Blueprint Was Already Here
In June 2022, a campaign kicked off that would eventually spin up over 3,000 domains and 6,000 websites impersonating more than 100 popular clothing, footwear, and apparel brands. Nike. Adidas. Puma. Skechers. New Balance. Timberland. Reebok. Vans. The North Face. Fossil. Guess. Kate Spade. Casio. The list goes on.
The operators behind it didn't have anything exotic. They had volume, patience, and a technique called domain aging. By 2023, when BleepingComputer reported on the operation based on research from brand-protection firm Bolster, the scheme had already been running under the radar for a year.
Here's why I keep coming back to this campaign in 2026: it was a proof-of-concept for something that AI has made dramatically easier to scale. Not because AI invented phishing. It didn't. But the parts of the operation that once required tedious manual labor—writing convincing product copy, spinning up localized storefronts, generating believable customer reviews—are exactly the kinds of tasks generative models can now handle in minutes. The infrastructure was already there. AI just lowers the cost of running it.
What Is AI in Cybersecurity?
AI in cybersecurity refers to machine-learning and generative-AI tools used to detect, prioritize, investigate, and respond to digital threats. Defenders apply these systems to identify anomalous traffic, classify suspicious domains, correlate threat signals, and accelerate analysis. Attackers can also use AI to produce more persuasive text or adapt lures. AI is an amplifier; it does not replace the underlying tactics or guarantee success.
The fake-store campaign illustrates why that distinction matters. BleepingComputer's reporting documented a large impersonation operation that relied on domain aging: operators registered domains and allowed them to accumulate age and legitimacy signals before using them in deceptive storefronts. This is a method, not evidence that the campaign itself used AI.
AI Cybersecurity Threats in 2026: The Parts That Could Scale
A campaign with thousands of sites demands repetitive work. AI could make some of that work faster, while the operation still depends on infrastructure, distribution, and victims' trust.
Product and storefront content. Generative tools can draft descriptions and adapt wording across product pages. That may reduce the effort needed to make cloned shops look populated, but it does not prove that operators in this specific campaign used AI.
Localization. Translation and rewriting tools can help tailor messages and storefront text for different audiences. More natural language can make suspicious content less obvious at first glance, although translation quality and context still need checking.
Impersonation lures. Generative AI can produce variations of promotional messages, delivery alerts, or customer-service replies. Phishing remains a human-trust problem: recipients should verify a seller or message through an independently located official channel rather than trusting a link in an unsolicited offer.
Operational analysis. On the defensive side, AI-enabled tools can group related domains, flag lookalike names, and help analysts triage reports. These capabilities support investigation but require reliable data and human review; a score or model output is not proof of malicious activity.
How AI Is Used in Cybersecurity Against Phishing
Security teams can use machine learning to assess domain, hosting, and message signals at scale, then prioritize suspicious activity for analysts. Language models can help summarize reports or assist with incident workflows, while automated monitoring can watch for brand impersonation and newly registered lookalike domains. Human analysts still need to validate findings, investigate context, and coordinate takedowns.
For shoppers, the practical defense is less technical: reach a retailer through its known official website or app, be cautious of unusually steep discounts, and avoid entering payment details after following unsolicited links. For organizations, combine brand monitoring, domain controls, employee reporting channels, and a response process for fraudulent sites. AI-based detection can complement these measures, not replace them.
The Bigger Lesson
The 2022 campaign showed that brand impersonation could already operate at substantial scale without advanced technology. In 2026, AI cybersecurity threats include the possibility that generative tools make content production and adaptation cheaper, while defensive AI can help sift through large volumes of signals. The enduring risks remain familiar: lookalike domains, social engineering, and misplaced trust.
The useful question isn't whether AI makes phishing possible. It already was. The question is whether defenders can spot and disrupt the infrastructure faster than attackers can reuse it—and whether shoppers pause long enough to check where a link really leads.
Related Reading
- AI cybersecurity defenses face zero-click espionage in Zimbra exploitation campaign
- AI cyber security threats and the human layer
