Fake ChatGPT and Gemini ad tools phish agency logins that unlock several clients' budgets
Island traced fake ChatGPT, Gemini, Claude and Perplexity ad tools to a phishing operation whose Telegram channel took hundreds of victim submissions. Its targets are agency buyers and admins, whose one login can spend several advertisers' balances.
The Watch · Security desk
What happened
- The phishers built their pitch around Meta's recent Muse AI agent launch, offering fake tools that promise ad briefs, buyer reach and campaign audits.
- A 'connect' button opens a fake Google sign-in window drawn inside the page, its address bar showing accounts.google.com.
- Once a victim is in, a live operator picks the prompts: the password up to three times, then SMS or authenticator codes, Okta pushes, Google approvals or QR codes.
- Older source code left in misconfigured public GitHub repositories let Island tie the ad pages to refund and recruitment lures going back to March.
Why it matters
- Who's exposed exposure Advertisers who never saw the fake page take the loss, because one agency login reaches their balances, which can be spent on fraudulent campaigns or sold on.
- What it limits constraint SMS codes, authenticator codes and push approvals fail against this flow, since each one goes to an operator who can reject it and ask again.
- What it sets up precedent The operation has already run refund, recruitment and AI-tool lures on one stack, so the next heavily covered product launch is a likely next pitch.
Next story · Build · Oct 2
Meta gave Muse up to half its daily house-ad impressions on the way to 5 million US downloadsConfirmed4 publishers
The campaign needs no software flaw. It is phishing aimed at the people who hold ad accounts. It is built on browser-in-the-browser, a technique a security researcher published in March 2022 that has been used heavily since, including against Steam accounts [1][20]. Island describes a kit tuned for ad-platform logins. It supports Google, Meta, TikTok and Okta sign-in flows [15] and redraws itself for Windows, macOS, iOS or Android, down to browser styling and dark mode [8].
Island's researchers separate it from proxy-based phishing. "Unlike a transparent reverse-proxy kit, the visible platform locally rebuilds the provider interface and collects credentials and MFA state through its own APIs," they wrote [16]. Operator commands travel as Socket.IO events [15]. On the wire, the session appears to be an AI product talking to an unrelated application backend [17].
The fake window has one physical limit. A genuine OAuth pop-up can be dragged outside the browser window and resized. The fake one is an iframe and can do neither [7][22].
The ad pages are one lure among several. I'd treat the operation as a standing service that swaps lures on fixed infrastructure [12][14]. Every page tied to it shares a Next.js and Socket.IO stack and common API endpoints, and many run on Vercel frontends with Railway or Render backends [13]. Island counted dozens of URLs across the ad, refund and recruitment campaigns and published the list with its report [18].
Scale is the weak part of the public record. Island cautions that the submission count in the operators' Telegram channel does not necessarily match the number of accounts actually compromised [21]. BleepingComputer's account of the research does not name a threat actor or give a figure for ad spend lost [19].
What to watch
- Whether Meta, Google or TikTok report agency ad-account takeovers or fraudulent spend linked to this kit.
- Whether the operation moves off Vercel, Railway and Render, or rebuilds its URLs, now that Island has published the list.
- Whether Island or another firm attributes the operation or publishes a confirmed count of compromised accounts.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude and Perplexity sites that steal login credentials and MFA codes through browser-in-the-browser attacks.
- [2]
The phishing operation leveraged the recent launch of Meta's Muse AI agent.
- [3]
The malicious pages target agency staff, media buyers and administrators with accounts that extend to multiple downstream clients.
- [4]
These accounts typically allow attackers to spend available balances on fraudulent ad campaigns or resell them to other cybercriminals.
- [5]
The fake AI products claim to help advertisers reach buyers, obtain ad briefs, and plan and audit advertising campaigns and spending.
- [6]
The 'connect' button opens a fake Google window inside the page, with an address bar showing accounts.google.com.
- [7]
The fake browser window is an iframe designed to steal the victim's credentials.
- [8]
The attacker's kit adapts the interface to Windows, macOS, iOS and Android, including browser styling and dark-mode support.
- [9]
Once the victim is in the browser-in-the-browser flow, a human operator takes over and controls what the victim is prompted to do next.
- [10]
The operator may ask for password entry up to three times, request an SMS or authenticator code, display Okta push requests, show Google approval prompts, or display a QR code.
- [11]
Operators can reject codes submitted by victims, hold them on a waiting screen, and finish or suppress the phishing flow at any time.
- [12]
The campaign is part of a larger operation that used multiple lures, including fake recruitment opportunities and refund pages.
- [13]
All pages tied to the operation share a Next.js and Socket.IO stack and common API endpoints, and many use Vercel frontends with Railway or Render backends.
- [14]
The attacker exposed older source code through misconfigured public GitHub repositories, letting researchers trace the activity as far back as March.
- [15]
The phishing platform supports Google, Meta, TikTok and Okta sign-in workflows, and commands are sent through Socket.IO events.
- [16]
"Unlike a transparent reverse-proxy kit, the visible platform locally rebuilds the provider interface and collects credentials and MFA state through its own APIs."
- [17]
This masks the traffic, making it appear to come from an AI product communicating with an unrelated application backend.
- [18]
The operation used dozens of URLs for campaigns focused on ads, refunds and recruitment, and Island's report lists all associated URLs.
- [19]
BleepingComputer's report on Island's research does not name a threat actor behind the operation or give a figure for losses.
- [20]
Browser-in-the-browser is a phishing technique devised by a security researcher in March 2022 and has been used extensively since, including against Steam accounts.
- [21]
The Telegram control channel received hundreds of victim submissions, though that figure does not necessarily reflect the number of successfully compromised accounts.
- [22]
Browser-in-the-browser iframes cannot be moved outside the browser window or resized, unlike a legitimate OAuth popup.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comFake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
1 article · October 6, 2026
- thehackernews.comFake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
1 article · October 6, 2026
Topics and entities
Topics
- MFA bypass techniques
- Browser-in-the-browser phishing
- Ad account takeover
- AI Brand Impersonation