A phishing campaign uses fake ChatGPT, Gemini, Claude, and Perplexity sites to steal login credentials and multi-factor authentication (MFA) codes from advertising account managers.

 

What happened

Researchers found that attackers built fake AI sites that target agency staff, media buyers, and administrators. The operation took advantage of the recent launch of Meta’s Muse AI agent. The fake sites claim to help advertisers reach buyers, obtain ad briefs, and plan and audit campaigns and spending.

To use the tools, visitors must connect their accounts. The “connect” button opens a fake Google window inside the page, complete with an address bar showing accounts.google.com. The window is an iframe built to steal the victim’s credentials. Once a victim enters the flow, a human operator controls what the victim sees next.

 

Going deeper

  • Attack kit: The attacker uses a kit that adapts the fake window to Windows, macOS, iOS, and Android, including browser styling and dark-mode support.
  • Operator controls: The attacker can ask for a password up to three times, request an SMS or authenticator code, display Okta push requests, show Google approval prompts, or display a QR code.
  • Victim handling: Operators can reject submitted codes, hold victims on a waiting screen, and finish or suppress the phishing flow at any time.
  • Supported logins: The platform supports Google, Meta, TikTok, and Okta sign-in workflows. It sends commands through Socket.IO events.
  • Larger operation: Other lures include fake recruitment opportunities and refund pages. The attacker exposed older source code through misconfigured public GitHub repositories, which let researchers trace the activity back to March.

 

What was said

Researchers explained that the platform differs from a transparent reverse-proxy kit. According to their report, the visible platform locally rebuilds the provider interface and “collects credentials and MFA state through its own APIs.” The researchers said this masks the traffic, so it appears to come from an AI product communicating with an unrelated application backend.

 

In the know

The browser-in-the-browser (BitB) technique creates a fake browser window inside a legitimate one to display a fraudulent login page. The fake window looks like a login pop-up, with realistic titles, interface, and the login URL the user expects.

 

Why it matters

This campaign targets agency staff, media buyers, and administrators who often manage accounts that extend to multiple downstream clients, so one stolen login can expose several advertisers at once. Attackers can spend available balances on fraudulent ad campaigns or resell the accounts to other cybercriminals.

The attack also fits what these users want. Fake AI tools that promise help with ad briefs, campaign planning, and spending audits appeal to advertising professionals. The human operator who controls each session lets attackers adapt to whatever MFA method a victim uses, including SMS codes, authenticator codes, push requests, and QR codes. This shows that MFA alone does not stop an attack when the victim hands the code to the attacker.

 

The bottom line

Advertising teams should treat any AI tool that asks them to connect an ad account with suspicion. A fake BitB window has one clear weakness, iframes cannot move outside the browser window or resize, while a legitimate OAuth popup can do both.

 

FAQs

What is a browser-in-the-browser (BitB) attack?

It is a phishing technique that builds a fake browser window inside a real one to show a fraudulent login page.

 

Why do attackers target ad account managers?

Their accounts often reach multiple downstream clients, so a single stolen login can give attackers access to several advertisers.

 

What can attackers do with a stolen advertising account?

They can spend the account’s available balance on fraudulent ad campaigns or resell the account to other cybercriminals.

 

How can someone tell a BitB login window is fake?

A fake window is an iframe, so it cannot be dragged outside the browser window or resized the way a legitimate pop-up can.