Fake Adobe Firefly / Leonardo.ai / Ideogram AI creative subscription suspended, generative credits depleted, image generation tokens unavailable, or Creative Cloud Firefly access blocked due to billing failure phishing

Phishing emails impersonating Adobe Firefly, Leonardo.ai, or Ideogram claiming the AI creative subscription has been suspended, generative credits have been depleted, image generation tokens are unavailable, or Creative Cloud Firefly access has been blocked due to a billing failure — directing victims to update their subscription through a credential-harvesting portal. A high-value attack category targeting the fastest-growing segment of AI tools. Key facts: (1) Adobe Firefly is integrated into Creative Cloud (33M+ subscribers at $54.99/month Photography, $59.99/month All Apps) as the generative AI layer powering Generative Fill in Photoshop, Generative Expand, Text Effects, and Firefly.adobe.com — a 'Firefly generative credits depleted, subscription access suspended' email is especially credible because Adobe's credit system is real and CC subscribers do run out of generative credits monthly; attackers exploit this familiarity; (2) Adobe Creative Cloud credentials are among the most valuable targets in creative industry phishing: CC credentials grant access to Adobe Stock (billions of licensed assets), Creative Cloud storage (all project files and assets), Adobe Express (brand assets), Adobe Sign (DocuSign competitor for contracts), Adobe XD (UI prototypes), and Adobe Analytics (enterprise data) — a single CC account compromise exposes a creative professional's entire work history and client deliverable archive; (3) Leonardo.ai serves 19M+ registered users with Apprentice ($10/month, 8,500 tokens), Artisan ($24/month, 25,000 tokens), and Maestro ($48/month) tiers — a 'Leonardo.ai Artisan plan payment failed, image generation tokens no longer available' email targets the core user value proposition (token-based generation); attackers craft these specifically because Leonardo sends legitimate low-token warning emails that users recognize; (4) Ideogram serves 5M+ users with a Pro plan ($8/month) known for best-in-class text rendering in AI images — a niche but growing target; 'Ideogram Pro subscription suspended, prompt credits no longer active' matches the notification style of the real platform; (5) Adobe Firefly phishing often doubles as a full Creative Cloud credential harvest: the brand recognition of 'Adobe' plus 'billing issue' creates immediate alarm because CC subscribers pay substantial monthly fees; the attack is amplified by Adobe's legitimate practice of notifying users about failed payments via email with a link to update billing. Warning signs: sender not adobe.com, leonardo.ai, or ideogram.ai; genuine Adobe billing at account.adobe.com; Leonardo.ai at app.leonardo.ai.