Researchers at Vigilance Security warn that a campaign they dubbed Dark Sourcery is attempting to poison responses generated by ChatGPT, Gemini, and Google AI Overview. Rather than attacking the chatbots directly, threat actors publish fake phone numbers, phishing email addresses, and fraudulent login pages on the web, then optimize the content so AI systems treat them as trustworthy sources. When users ask how to get in touch with an airline, bank, or familiar service, the AI can serve up that very scam information.
Attacking data sources instead of prompts
Vigilance Security reported uncovering fake posts, PDFs, reviews, and support pages optimized using a technique marketers refer to as GEO, short for Generative Engine Optimization. The legitimate goal of GEO is to help content get discovered and cited by AI engines. In Dark Sourcery, that same optimization method is exploited to feed false information into the chain of sources referenced by AI models.
This differs from prompt injection. Attackers do not need to submit malicious instructions directly into the chat session, rendering many defensive measures centered on malicious prompt detection ineffective. The fraudulent details appear as objective facts within the AI’s own response, often without users ever seeing the underlying source page.
Dark Reading quoted Ariel Simon, Vice President of Research at Vigilance, as saying the team suspects that combining high-reputation domains—such as universities or government agencies—with user-generated content sources like forums and reviews has increased the success rate of poisoning AI results.
374 brands targeted, according to Vigilance
According to Vigilance’s research, the campaign has targeted at least 374 companies, spanning airlines, banks, travel platforms, software vendors, and Fortune 100 enterprises. Prominent names mentioned include Delta, Lufthansa, Qatar Airways, Chase, Bank of America, Airbnb, and TripAdvisor.
The research team stated they identified tens of thousands of malicious pages hosting fraudulent customer support numbers, email addresses, login links, software updates, and other deceptive details. This content was distributed across social networks, discussion forums, file-hosting platforms, website builders, review portals, and various sites supporting public content submissions.
The researchers also noted that results were not always reproducible: the same query might not surface fraudulent details on every single attempt. However, the higher the quality of the poisoned content, the greater the likelihood that an AI system cites it.
The risk lies in overreliance on AI answers
Some victims have reportedly dialed fake phone numbers provided by chatbots, only to be asked for payment details under the guise of “rebooking a flight” or “unlocking a bank account.” While this constitutes a familiar phishing scheme, the attack vector has evolved: rather than enticing users to click suspicious links directly, attackers wait for an AI engine to present those links or phone numbers as trusted recommendations.
Vigilance cited a survey indicating that 91% of chatbot users do not verify AI-generated answers. While this figure should be regarded as an indicator from the study cited rather than an established industry-wide metric, it highlights an evident vulnerability: users who typically stay alert to ads and unfamiliar websites often accept AI assistants as a dependable filter.
What to verify before taking action
For end users, high-risk details such as customer service phone numbers, support emails, login URLs, software download links, and payment instructions should never be trusted solely from AI answers. Always cross-check them against the brand’s official website, an installed mobile app, or established support channels.
For businesses, Dark Reading advises monitoring chatbot responses generated about their own brands, especially regarding workflows for customer support, account recovery, refunds, payments, and software downloads. As AI increasingly emerges as the new search interface, safeguarding accurate information on the web is no longer merely the responsibility of SEO or communications teams. It has become a vital segment of the overall attack surface that organizations must continuously monitor.