Fake AI Ad Portals Steal User Credentials and MFA Codes

A human-operated phishing platform is impersonating ad management tools for major artificial intelligence products to steal credentials and multi-factor authentication codes, The Hacker News and BleepingComputer reported. The campaign specifically targets advertising account managers using fake portals that impersonate tools for OpenAI ChatGPT, Google Gemini, Anthropic Claude, Perplexity, Meta Muse, and Manus. [1][2]

According to The Hacker News and BleepingComputer, the fraudulent websites use browser-in-the-browser login windows to capture incoming multi-factor authentication codes and account passwords. The fake portals promise campaign optimization, spend audits, and business account connections, but rely on a connect action that displays a fake browser window drawn inside the actual browser. Island researchers Oleg Zaytsev and Ofek Ronen reported that each fake product was built around this single malicious connection action. [1][2]

BleepingComputer reported that the phishing campaign also exploited the public launch of Meta Muse, an artificial intelligence assistant created for personal tasks. ChatGPT is a generative artificial intelligence chatbot developed by OpenAI that uses large language models to produce text and image responses. [2][5]

Multi-factor authentication requires users to present two or more distinct pieces of evidence before access is granted, which helps protect personal and financial data if a password is compromised. Security teams should inform system administrators and advertising managers about browser-in-the-browser attacks to prevent unauthorized credential capture. [1][2][6]