Fake ChatGPT, Gemini and Claude ad portals capture credentials and MFA codes with operator-driven phishing
Island found a human-operated phishing platform posing as AI advertising tools. A browser-in-the-browser Connect window steals Google and Okta credentials while a live operator picks which MFA challenge to show next.
Researchers at Island describe a human-operated phishing platform posing as AI advertising tools from Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Manus and Meta's new Muse. Each fake portal centres on a "Connect" button that draws a browser-in-the-browser window showing an accounts.google.com or Okta address bar while the real tab stays on the phishing domain. The kit fingerprints the device, records up to three password attempts and lets an operator, watching over Socket.IO, choose which MFA challenge the victim sees next: SMS or authenticator codes, Google prompts, number taps or Okta push. Targets are media buyers and ad manager-account administrators, whose accounts hold payment methods and client access. The museads.ai lure was live by September 16, eight days after Meta announced Muse. The same backend also serves fake refund and recruitment pages, and earlier builds leaked through public GitHub repositories.
Why it matters
This is a live relay, not a credential dump. Because a human replays each password and code against the real service within seconds, any MFA factor the user can type or approve (SMS, TOTP, push, number matching) is passed straight through. The browser-in-the-browser window also defeats "check the address bar" training, since the address bar is part of the attacker's page. The only factors that hold are origin-bound ones, such as passkeys and security keys, which will not sign for a domain that is not the real one.
For teams running paid media: require phishing-resistant sign-in for anyone with manager-account rights, connect AI or ad tools only from the vendor's own site, and after any suspected exposure review ad accounts for new managers, changed recovery details and unexpected spend. The technique is the same one behind AitM phishing proxies and the earlier RecruitTrap browser-in-the-browser campaign.
Source: The Hacker News
Related on Start with Identity
- BlogKratos phishing-as-a-service dismantled: 200 servers, 1,800 customers, MFA walked past every time
German, US, and Indonesian authorities took down Kratos (tracked by Microsoft as SneakyLog), a phishing-as-a-service kit that used a Node.js reverse proxy to re
- BlogUAT-11985 uses fake event invites to hit Taiwan research affiliates with Google AitM phishing
Cisco Talos tracks UAT-11985, a spear-phishing campaign that lures Taiwan research affiliates with event invitations, then relays their Google passwords and MFA
- BlogDevice code phishing industrialises: 25 kits, and Microsoft counts new campaigns daily
The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by
- CVESimpleHelp accepts unsigned OIDC tokens, MFA bypass
SimpleHelp through 5.5.15 (and 6.0 pre-release) accepted OIDC ID tokens without signature verification, including alg:none. A forged token bypasses MFA. Patch i
- CVEVault LDAP MFA enforcement bypass
Vault's LDAP auth method could be convinced to skip MFA enforcement. One of the VaultFault MFA-plane bugs. NVD CVSS was not confirmed at the time of the origina
- CVEVault TOTP login MFA bypass
Vault's TOTP login MFA could be bypassed. Companion to the LDAP MFA bypass in the VaultFault set. Confirm the score against NVD; vendor and researcher figures c