Artificial Intelligence
Fake AI sites stole ad logins and MFA codes
Researchers said a phishing campaign used fake AI service pages to target advertising account holders, steal credentials and MFA codes, and route victims through browser-in-the-browser login flows.
- Researchers at Island said a phishing campaign used fake ChatGPT, Gemini, Claude and Perplexity pages to steal login details and multi-factor authentication codes.
- The targets included agency staff, media buyers and administrators whose accounts could reach multiple downstream clients.
- Island said the operation used browser-in-the-browser pop-ups and human operators who then directed victims through passwords, SMS or authenticator codes, Okta push prompts, Google approval prompts or QR codes.
- The researchers linked the activity to a broader operation that also used fake recruitment and refund pages, and they traced it back to March through exposed source code in public GitHub repositories.
- Island said the Telegram control channel connected with the attacks had received hundreds of submissions, although that did not necessarily mean hundreds of accounts were compromised.
Researchers at browser security company Island said a phishing campaign used fake versions of ChatGPT, Gemini, Claude and Perplexity to target advertising account managers. The operation stole login credentials and multi-factor authentication codes through browser-in-the-browser pages.
Island said the pages were aimed at agency staff, media buyers and administrators who held access to multiple client accounts. Those accounts could be used to spend remaining balances on fraudulent ad campaigns or sold on to other criminals.
To continue, the victim had to connect an account to the fake service. The connect step opened a counterfeit Google sign-in window inside the page, with an address bar that showed accounts.google.com.
Island said the attacker used a kit that adjusted to different devices and browsers, and that a human operator then controlled the next prompts. The flow could ask for passwords, SMS or authenticator codes, Okta push requests, Google approval prompts or QR codes.
The researchers also said the phishing activity sat inside a wider operation that used fake recruitment and refund pages. Shared code, common endpoints, Next.js and Socket.IO components, and Vercel, Railway and Render hosting pointed to the same group, while a Telegram control channel had received hundreds of submissions.
Named in this story
People
- mr. dox
- devised the browser-in-the-browser technique in March 2022
Companies
- Meta
- described Muse AI agent as an assistant for personal tasks
- Island
- its researchers analysed the phishing campaign
- its sign-in page was mimicked in the fake login window
- Okta
- its push prompts were among the login steps the attackers showed
- Vercel
- used for front-end hosting by many pages
- Railway
- used for back-end hosting by some pages
- Render
- used for back-end hosting by some pages
Products and systems
- ChatGPT
- one of the fake AI services impersonated on the phishing pages
- Gemini
- one of the fake AI services impersonated on the phishing pages
- Claude
- one of the fake AI services impersonated on the phishing pages
- Perplexity
- one of the fake AI services impersonated on the phishing pages
- Muse AI agent
- its launch was used in the lure
- Next.js
- part of the shared stack used by the pages
- Socket.IO
- used for the campaign's command traffic
- Telegram
- its control channel received victim submissions
How the source tells it
The article was written in a technical warning register, with threat emphasis coming from its focus on stolen credentials, MFA bypass and active operator control.
- alarm the story centred on stolen logins, MFA interception and account takeover
- urgency it framed the phishing as an active campaign with human operators and a large submission count