A phishing operation is using fake advertising portals for ChatGPT, Google Gemini, Anthropic's Claude and other AI products to steal ad-account logins and multifactor authentication codes from agency staff and media buyers, The Hacker News reported Tuesday. Researchers Oleg Zaytsev and Ofek Ronen of the browser security company Island documented the campaign.

What Happened

The lures pose as sign-up pages for ad programs on AI platforms, including ChatGPT, Gemini, Claude, Perplexity, Meta's Muse and Manus. One domain, museads.ai, appeared Sept. 16, about a week after Meta launched its Muse shopping agent.

Victims who try to sign in are shown a browser-in-the-browser pop-up, a fake window drawn inside the real browser tab. Its imitation address bar displays trusted origins such as accounts.google.com or a company's Okta sign-in page, while the victim is in fact still on the phishing site.

RelatedFBI Warns Scammers Are Using AI to Impersonate Candidates Ahead of the Midterms

Behind the page, operators watch login attempts as they happen. According to the researchers, the platform stored every password attempt, fingerprinted each visitor's device and let an operator pick which MFA challenge the victim would see next, so the attacker could complete a real sign-in to the targeted account while the victim was still on the fake page.

The operation went after Google, Meta, TikTok and Okta credentials, with a focus on accounts run by agencies, including manager accounts with a clean spending history that can be resold or used to run malicious ads.

Why It Matters

The campaign takes advantage of a real development. As AI companies roll out advertising, marketers are looking for ways to buy placements, which makes a search ad or landing page promoting a new AI ad program look plausible to the people it targets.

Real-time relaying of logins also undercuts common second factors. One-time codes and push approvals can be passed along by a live operator just as easily as a password, which is why the researchers recommend phishing-resistant authentication such as passkeys or hardware security keys for ad and identity accounts.

Agency ad accounts are valuable to criminals because they come with payment methods, spending history and trust signals that ad platforms use to decide whether to approve campaigns. A hijacked manager account can give access to many client accounts at once.

Inside the Kit

The researchers found that every site they identified was built with the Next.js web framework and the Socket.IO real-time messaging library and talked to shared back-end endpoints. Device fingerprint data was sent to an endpoint at /api/send/ip. The operators exposed source code for earlier versions of the platform through misconfigured public GitHub repositories, which helped the researchers reconstruct how it works.

The AI-themed portals are one part of a larger delivery network. In the three months through August, the wider cluster included about 850 paid-ad landing pages, 26 lookalike ChatGPT destinations and 71 Google Ads campaign IDs, according to the report. BleepingComputer also reported on the campaign Tuesday.

What to Watch

The researchers advised organizations to move ad and identity accounts to phishing-resistant sign-in, closely review changes to who controls ad accounts and vet AI integrations before connecting accounts to them. Next steps to watch include takedowns of the lookalike domains and whether OpenAI, Google, Anthropic, Meta and other companies selling AI ads add advertiser verification or warnings about fake portals.