Reported by 2 outlets
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.33 / 0.6 · time to second source
- Recency
- × 0.01 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
A phishing campaign uses fake ChatGPT, Gemini, Claude, and Perplexity sites to steal advertising account credentials and MFA codes through browser-in-browser attacks. Researchers found the malicious pages target agency staff and media buyers whose accounts extend to multiple downstream clients, letting attackers spend balances on fraudulent campaigns or resell accounts. The operation leveraged the Muse AI agent launch and relied on a fake Google login iframe displaying accounts.google.com to harvest credentials.
The attack targets high-value ad-management accounts rather than individual consumers, and the browser-in-browser technique (devised by mr. dox in March 2022) remains effective because the fake window shows the correct URL and interface. There are no CVEs linked to this campaign; the threat is purely social-engineering and credential theft. Watch for reports of actual financial losses from compromised agency accounts or additional AI-product impersonation pages.
Timeline
-
original reporting
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
bleepingcomputer.com · 7d ago · October 6th, 2026
A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. Researchers found that the phishing operation leveraged the recent launch of the Muse AI agent, which Meta describes as an assistant for various personal tasks. The malicious pages target agency staff, media buyers, and administrators with accounts that extend to multiple downstream clients. These accounts also typically allow attackers to spend available balances on fraudulent ad campaigns or resell them to other cybercriminals for significant amounts. On the phishing sites, the fake AI products claim to help advertisers reach buyers, obtain ad briefs, and plan and audit advertising campaigns and spending. To get the benefits, the user had to connect their account to the fake AI product. However, the "connect" button opens a fake Google window inside the page, complete with an address bar showing accounts.google.com. Browser-in-the-browser is a phishing technique devised by cybersecurity researcher mr. dox in March 2022 that consists of creating a fake browser window inside a legitimate one to display a fraudulent login page. The fake window looks like a login pop-up, featuring realistic titles, interface, and the login URL expected by the user. But the fake window is just an iframe designed to steal the victim’s credentials. The technique has been used extensively ove
-
update from gbhackers.com
Fake ChatGPT, Claude and Gemini Ads Use Browser-in-the-Browser Phishing to Steal Accounts
gbhackers.com · 6d ago · October 7th, 2026
A human-operated phishing platform impersonating AI advertising products to steal credentials and manipulate multifactor authentication workflows. The operation targets advertising professionals through convincing account-connection pages, with researchers observing hundreds of victim submissions and continued activity during their investigation. Rather than presenting an obvious password request, the attackers sell a plausible business workflow: campaign optimization, spending […] The post Fake ChatGPT, Claude and Gemini Ads Use Browser-in-the-Browser Phishing to Steal Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by www.bleepingcomputer.com
Fake # ChatGPT , # Gemini Sites steal advertising accounts, # MFA codes https://www. bleepingcomputer.com/news/secu rity/fake-chatgpt-gemini
www.bleepingcomputer.com · 6d ago · October 7th, 2026