# Fake ChatGPT, Gemini and Claude ad portals capture credentials and MFA codes with operator-driven phishing

Source: https://startwithidentity.com/blog/2026-10-06-fake-chatgpt-gemini-and-claude-ad-portals-capture-credentials-and-mfa-codes/
Last updated: 2026-10-06
License: content by Start with Identity. Cite the source URL.

---

Researchers at Island describe a human-operated phishing platform posing as AI advertising tools from Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Manus and Meta's new Muse. Each fake portal centres on a "Connect" button that draws a browser-in-the-browser window showing an accounts.google.com or [Okta](https://startwithidentity.com/vendors/iam/okta/) address bar while the real tab stays on the phishing domain. The kit fingerprints the device, records up to three password attempts and lets an operator, watching over Socket.IO, choose which MFA challenge the victim sees next: SMS or authenticator codes, Google prompts, number taps or Okta push. Targets are media buyers and ad manager-account administrators, whose accounts hold payment methods and client access. The museads.ai lure was live by September 16, eight days after Meta announced Muse. The same backend also serves fake refund and recruitment pages, and earlier builds leaked through public GitHub repositories.

## Why it matters

This is a live relay, not a credential dump. Because a human replays each password and code against the real service within seconds, any MFA factor the user can type or approve (SMS, TOTP, push, number matching) is passed straight through. The browser-in-the-browser window also defeats "check the address bar" training, since the address bar is part of the attacker's page. The only factors that hold are origin-bound ones, such as [passkeys and security keys](https://startwithidentity.com/glossary/phishing-resistant-mfa/), which will not sign for a domain that is not the real one.

For teams running paid media: require phishing-resistant sign-in for anyone with manager-account rights, connect AI or ad tools only from the vendor's own site, and after any suspected exposure review ad accounts for new managers, changed recovery details and unexpected spend. The technique is the same one behind [AitM phishing proxies](https://startwithidentity.com/techniques/aitm-phishing-proxy/) and the earlier [RecruitTrap browser-in-the-browser campaign](https://startwithidentity.com/blog/2026-08-14-recruittrap-browser-in-the-browser-recruitment-phishing/).

Source: [The Hacker News](https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html)