Researchers have uncovered a widespread campaign that manipulates ChatGPT, Gemini, and Google AI Overview into citing fraudulent contact information for 374 major brands.
Security firm Vigilance has documented an active, large-scale disinformation campaign that exploits how generative AI models source and cite information, tricking ChatGPT, Google Gemini, and Google’s AI Overview into surfacing fake phone numbers, email addresses, and login pages as legitimate brand contact information.
The affected organisations span Fortune 100 companies, major airlines (Delta, Lufthansa, United, Emirates, Qatar Airways), top-tier banks (Bank of America, Wells Fargo, Chase, Citi), and travel platforms (Airbnb, TripAdvisor) — 374 companies in total, according to the researchers’ findings.
The Technique: Generative Engine Optimization, Weaponized
The attack repurposes Generative Engine Optimization (GEO) — a legitimate discipline marketers use to get AI models to cite their content — for fraud. Researchers built a detection pipeline that queries the three AI platforms and their underlying sources, scoring each for signs of GEO-driven manipulation and flagging cases where a fabricated phone number, URL, or email address was returned as fact. The scan surfaced tens of thousands of malicious pages across mainstream platforms.
Unlike classic phishing infrastructure hosted on throwaway domains, the poisoned content lives on trusted, high-traffic surfaces: social media, forums, YouTube and Vimeo video descriptions, Medium, GitHub Pages, WordPress sites, PDF uploads to .edu and government domains, and job boards and fundraising platforms. Any site that accepts user-generated content is a viable delivery vector.
Researchers identified five recurring techniques:
GEO-optimized payloads — fake contact details wrapped in FAQ formatting with urgency language (“call now,” “updated 2026”) designed to trigger AI citation.
Semantic obfuscation — the same phone number rendered dozens of different ways (spacing, Unicode substitution, spelled-out digits) to evade filter matching while an LLM still tokenizes it as identical.
Cross-platform saturation — identical content replicated across unrelated domains to simulate independent corroboration.
Authenticity camouflage — fake data interleaved with real information, AI-generated images, and fabricated engagement metrics.
Manufactured urgency — content built around high-stress scenarios (canceled flights, locked accounts, refund requests) to short-circuit verification behavior.
Why Takedowns Don’t Work
The campaigns are fully automated, with researchers observing hundreds of new posts per platform per targeted company, per day. Content removal is further undermined by web archival services: pages indexed by the Wayback Machine remain crawlable by search engines and AI systems even after the source is taken down. In one documented case, fraudulent content targeting American Airlines, posted on LeetCode, generated more than ten pages of Google results within 24 hours; an associated fraudulent PDF remained live on a web archive after the original was removed.
Vigilance says that it disclosed its findings to affected companies via bug bounty, fraud, and security channels, and separately to Google and OpenAI. The reception was mixed at best. Several targeted companies were unaware of the issue’s scale; some argued it fell outside their bug bounty scope because it didn’t touch internal infrastructure.
Google classified the report as out of scope, stating that AI-generated misinformation and social-engineering scenarios are not covered under its vulnerability rewards program. OpenAI closed its report as unreproducible, citing a lack of demonstrated user impact.
The core issue: because the attack manipulates content the AI retrieves and repeats, rather than the AI vendor’s own systems, it falls outside how either company currently defines a reportable vulnerability.
Risk Exposure
Researchers frame the business impact in three categories: Revenue loss from customers redirected to fraudulent contact points during active purchase or support intent; Brand and trust erosion, as victims typically attribute the scam to the impersonated company rather than the attacker and Legal and support overhead from resulting disputes, chargebacks, and potential litigation.
This fraud campaign works precisely because it targets a gap nobody owns yet. Security teams monitor infrastructure. Marketing teams monitor search rankings and social sentiment. Fraud teams monitor transactions. None of them are systematically checking whether ChatGPT, Gemini, or AI Overview are handing customers a fraudulent phone number when they ask “how do I contact an ‘x’ company.”
The uncomfortable truth is that this isn’t a bug that gets fixed in a future model release. It’s a structural consequence of how generative AI sources information: it will cite whatever looks most authoritative, and authority, right now, can be manipulated.
Source: Ariel Simon, “Dark Sourcery: How Hackers Manipulate AI to Scam You,” Medium, September 22, 2026.