Security researchers have uncovered a phishing operation that borrows the branding of the world’s biggest AI chatbots to do something far older than generative AI: steal passwords and one-time codes. According to The Hacker News, researchers at Island detailed a “human-operated phishing platform” built around fake advertising and analytics portals that impersonate OpenAI’s ChatGPT, Google’s Gemini, Anthropic’s Claude, Perplexity, Meta Muse, and Manus. The report, published October 6, 2026, and corroborated the same week by shattered.io and CyberSecurityNews, describes a campaign that does not just phish for a password. It phishes for the whole login session, MFA code included.
The timing matters. Every one of the six brands being impersonated has spent 2026 pushing AI-powered advertising and campaign-management tools at marketers, so a fake “AI ads manager” landing page does not look out of place in anyone’s inbox or search results right now. That familiarity is exactly what the operators behind this campaign appear to be exploiting.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Security Researchers Found
Island researchers Oleg Zaytsev and Ofek Ronen built the core finding around a single observation: every fake portal, regardless of which AI brand it was dressed up as, funneled visitors toward the same action, a button labeled “Connect.” Clicking it is where the real attack begins, The Hacker News reported. Instead of redirecting to a real OAuth consent screen, the site draws a fake browser window directly inside the page the visitor is already looking at, a technique security researchers call browser-in-the-browser, or BitB.
One of the identified domains, museads.ai, surfaced on September 16, 2026, according to reporting reviewed by The Hacker News. It billed itself as an AI ads manager for paid media workflows, promising to help marketers connect ad accounts and run sponsored placements. That pitch is specific enough to pass a quick glance from a busy media buyer, and generic enough to be cloned across other fake domains using different AI brand names.
How the Browser-in-the-Browser Trick Works
Browser-in-the-browser phishing is not new, but this campaign applies it with unusual polish. When a visitor clicks “Connect,” the page renders a fake popup window complete with a fake title bar, fake window controls, and a fake address bar pre-filled with a trusted-looking URL, such as accounts.google.com or an Okta tenant subdomain. The real browser’s actual address bar never changes. It still shows the attacker’s domain. But most people do not check the browser’s real address bar when a familiar-looking login popup appears, especially when they clicked a button expecting exactly that popup to appear.
Inside that fake window, victims are walked through what looks like a completely normal login flow for Google, Meta, TikTok, or Okta, the services most commonly tied to advertising-account access, according to the reporting synthesized from The Hacker News and BleepingComputer coverage. The difference is that every field the victim fills in gets captured by the attacker’s backend in real time rather than sent to the real identity provider.
A Live Operator, Not Just a Bot
The detail that separates this campaign from a routine credential-harvesting page is that a human operator appears to be watching the session unfold and reacting to it live. The platform reportedly uses Socket.IO, a real-time web communication library, to keep a live channel open between the victim’s browser session and whoever is running the attack on the other end. That lets the operator hold the victim on a waiting screen while deciding what to show next.
CyberPress reported that the backend exposes a set of operator commands the attacker can trigger mid-session, including requests for a password, a one-time code from SMS, a code from an authenticator app, a Google approval prompt, an Okta push approval, and a command to reject whatever MFA code the victim just entered and ask for another one. That rejection step is the most dangerous part of the flow: it lets the operator try a stolen code immediately against the real account, and if it has already expired, simply ask the victim for a fresh one.
/password
/2fa
/authApp
/googlePrompt
/oktaApprove
/wrong2faThose six commands, as reported by CyberPress, describe a phishing kit built less like a disposable scam page and more like a call-center dashboard, one designed to be operated by a person sitting at a keyboard watching victims move through a fake login in real time.
Who Is Being Targeted
The reporting is consistent on who the operators are after: agency employees, media buyers, and advertising-account administrators, the people who hold the keys to Google Ads, Meta Ads, TikTok Ads, and connected Okta single sign-on environments. That is a deliberate choice of target. A compromised personal email account is annoying. A compromised advertising account with spending authority and payment methods attached is a direct line to money, and in some cases to the audiences and brand reputation of whatever company owns that account.
The available reporting does not identify a confirmed distribution channel, meaning there is no verified evidence yet that the lure ads were bought through Google Ads, Meta’s ad network, or any other named advertising platform. It also does not name a specific threat actor or criminal group behind the operation, nor does it give a verified count of victims, compromised accounts, or financial losses. Those gaps are worth stating plainly rather than filled in with guesses, since the value of this story is the mechanism it exposes, not a body count that reporters have not yet confirmed.
What Data Actually Gets Stolen
Based on the combined reporting from The Hacker News, BleepingComputer, and CyberSecurityNews, the platform is built to capture a wide range of authentication material in a single session:
- Usernames and passwords, including multiple password attempts if the first one fails
- SMS-based one-time codes
- Authenticator-app (TOTP) codes
- Google approval and number-matching prompts
- Okta push-approval responses
- Device-fingerprint data tied to the victim’s browser session
Capturing device-fingerprint data alongside credentials is notable because many platforms use device recognition as a secondary trust signal. If an attacker can replay both the stolen credentials and a convincing device fingerprint, some risk-based authentication systems may treat the login as familiar rather than suspicious, even without a fresh MFA challenge.
Campaign Snapshot
| Detail | What Is Reported |
|---|---|
| First public report | October 6, 2026 (The Hacker News, BleepingComputer) |
| Research firm | Island (researchers Oleg Zaytsev, Ofek Ronen) |
| AI brands impersonated | ChatGPT, Gemini, Claude, Perplexity, Meta Muse, Manus (6 total) |
| Attack technique | Browser-in-the-browser (BitB) fake login popup |
| Known fake domain | museads.ai, first observed September 16, 2026 |
| Real-time backend | Socket.IO-based live operator console |
| Identity providers spoofed | Google, Meta, TikTok, Okta |
| Primary targets | Agency staff, media buyers, ad-account admins |
| Confirmed victim count | Not disclosed in current reporting |
| Named threat actor | Not disclosed in current reporting |
Why Advertising Accounts Are Such a High-Value Target
Advertising accounts sit in an odd blind spot in most companies’ security programs. IT teams lock down email and file storage with MFA and conditional access, but ad platforms are frequently managed by marketing teams operating outside that same security perimeter, sometimes with shared logins or loosely governed agency access. A stolen advertising account can be used to launch fraudulent campaigns billed to the victim’s card, redirect existing campaign budgets to attacker-controlled destinations, or pivot into connected business accounts that share the same single sign-on session.
There is also a reputational angle unique to ad accounts: a hijacked account does not just lose money, it can push malicious or embarrassing ads under a legitimate brand’s name while that brand’s own audience is watching. That is a different kind of damage than a typical credential-stuffing breach, and it is part of why this campaign specifically chasing ad-account administrators is worth treating as a distinct risk category rather than filing it under generic phishing.
Browser-in-the-Browser vs. Older Phishing Techniques
BitB is effective precisely because it defeats the advice security teams have repeated for two decades: check the address bar before you type your password. The table below compares how this campaign’s approach stacks up against more familiar phishing methods.
| Technique | Address Bar Check Catches It? | Can Bypass MFA | Automation Level |
|---|---|---|---|
| Classic fake login page | Yes | No (unless MFA relay added) | Fully automated |
| Session-cookie theft (infostealer malware) | N/A, no login page shown | Yes, bypasses MFA entirely | Fully automated |
| Reverse-proxy phishing kit (e.g. Evilginx-style) | Partially, URL still visible but altered | Yes, relays live MFA | Mostly automated |
| Fake AI ad portal (this campaign) | No, fake address bar sits inside real page | Yes, live operator relays codes | Human-operated |
The human-operated piece is what pushes this campaign closer to the pattern seen in large-scale phishing-as-a-service operations. Microsoft’s disruption of the EvilTokens phishing-as-a-service network, which hit roughly 12,000 inboxes before being dismantled, showed how commercialized and operationally mature MFA-targeting phishing has become. A live operator reacting to each victim in real time is a labor-intensive model, but it is also harder for automated detection systems to fingerprint than a static phishing kit replayed thousands of times.
Historical Context: AI Branding as the New Phishing Lure
Phishing has always borrowed whatever brand is trending. A decade ago it was fake bank portals and PayPal lookalikes. More recently it has been fake software updates and fake delivery-tracking pages. 2026 is shaping up to be the year AI branding became the default costume, because AI tool names now carry the same instant credibility that a bank logo used to. ChatGPT, Gemini, and Claude are household names among the exact audience, marketers and advertising professionals, that this campaign is targeting.
This also lands at a moment when the real companies behind those brands are themselves racing to ship legitimate AI-powered advertising tools, which makes the fake versions easier to believe. Anthropic recently cut prices on its Claude Haiku line by 75% to push adoption into more workflows, and Google has been narrowing its free Gemini tiers while pushing its newer Argon-generation models, two signals of just how aggressively AI vendors are competing for exactly the business-tool use cases this phishing campaign impersonates.
How This Compares to Other 2026 Credential-Theft Campaigns
This campaign is not happening in isolation. 2026 has already produced a steady drumbeat of large-scale credential and identity incidents, from the group known as ShinyHunters to a string of ransomware groups pivoting toward pure data theft rather than encryption. What distinguishes the fake AI ad portal campaign is its precision: rather than casting a wide net across random internet users, it is built specifically to catch professionals who manage paid advertising budgets and who are primed to click on tools promising to make that job easier.
That precision mirrors a broader shift security researchers have been tracking all year, where attackers increasingly research their target population before building the lure, rather than mass-producing generic phishing pages. It also lines up with a trend toward attacking the identity layer directly instead of exploiting software vulnerabilities, since a convincing fake login screen is often cheaper to build and harder to patch than a zero-day.
Market Impact: Trust in AI-Branded Business Tools
The immediate market impact is harder to quantify than a data breach with a disclosed record count, because this is a phishing campaign rather than a confirmed compromise of any AI vendor’s own systems. There is no indication in current reporting that OpenAI, Google, Anthropic, or any other impersonated company had its own infrastructure breached. The risk here sits entirely on the victim side: marketing teams and agencies who adopt the next AI ad tool that crosses their feed.
Still, there is a slower-moving cost. Every successful impersonation campaign chips away at the baseline trust that makes it easy to sell a new AI tool to a marketing team. As more AI vendors launch legitimate advertising and analytics products, each one now has to compete not just on features but on convincing a cautious buyer that it is not the next museads.ai. Vendors that lean on phishing-resistant sign-in, like passkeys or hardware security keys, rather than password-plus-SMS logins, have a real differentiation argument to make here, not just a compliance checkbox.
How to Protect Advertising and AI Tool Accounts
The defenses that matter most against browser-in-the-browser phishing are mostly behavioral, because the technique is specifically designed to defeat a quick visual glance at a familiar-looking popup. Security teams reviewing this campaign point to a short list of practical steps.
- Never trust a login popup rendered inside a web page. Drag the popup window off the edge of the browser; a real OS-level popup will move independently, a fake BitB popup is trapped inside the page.
- Navigate to AI and advertising tools directly through a bookmark or manually typed URL rather than clicking a sponsored ad or unsolicited link.
- Treat any unexpected Google approval prompt, Okta push, or number-matching request as a sign someone else already has your password, not routine friction.
- Move high-value accounts, especially advertising admin accounts, to phishing-resistant authentication such as FIDO2 security keys or passkeys, which cannot be relayed through a fake login window the way a typed code can.
- Use a password manager with domain-matching autofill, since it will simply refuse to fill credentials into an attacker’s domain even if the page looks identical to the real thing.
- Audit advertising account activity regularly for new administrators, new connected business accounts, or billing changes.
The FIDO Alliance’s guidance on passkeys is relevant here precisely because passkeys are cryptographically bound to the real domain, which makes them immune to the fake-address-bar trick that BitB relies on. Our breakdown of the business case for passkeys covers why that domain-binding property matters more than most MFA marketing admits. Hardware options like those compared in our YubiKey 5 FIPS vs. Titan vs. FEITIAN security key comparison offer the same domain-binding protection for teams not ready to move fully to passkeys.
What Companies Managing AI Agent Credentials Should Watch
There is a second-order lesson here for any team now wiring AI agents into advertising workflows: the credentials those agents use are just as attractive a target as a human’s, and in some ways more so, because an agent’s API keys and OAuth tokens rarely get the scrutiny a human login gets. Our 13-step guide to securing AI agent credentials through an MCP gateway walks through the kind of scoped, short-lived access controls that limit the damage if an agent’s token is ever captured the same way this campaign captures human sessions. Deepfake-resistant identity checks, the kind covered in our roundup of deepfake-resistant identity verification platforms, are also increasingly relevant as attackers blend AI branding with social-engineering scripts that a live operator can adjust in real time.
Predictions: Where This Threat Goes Next
Based on how similar campaigns have evolved over the past two years, a few directions look likely over the next several months.
- Expect more AI brand names added to the impersonation list as new AI advertising and analytics tools launch, since the lure template, a fake “Connect” button leading to a BitB popup, is reusable across any brand with minimal rework.
- Expect advertising platforms themselves to face pressure to add stronger phishing-resistant authentication options by default for business and agency accounts, rather than leaving MFA choice entirely up to individual advertisers.
- Expect security vendors to roll out BitB-specific detection features in browsers and endpoint tools, similar to how phishing-as-a-service takedowns like EvilTokens pushed Microsoft to harden conditional access defaults.
- Expect copycat campaigns targeting other professional categories beyond advertising, such as finance teams managing payment-platform logins or HR teams managing payroll-provider accounts, using the same human-operated BitB model.
- Expect slower adoption of new, unverified AI business tools among larger marketing organizations in the near term, as procurement and security teams add extra vetting steps in response to this kind of impersonation.
The Bottom Line for Marketing and Security Teams
Nothing in this campaign relies on a software vulnerability. It relies on a convincing fake window and a human being patient enough to wait for a victim to type in the right code. That makes it cheap to run and hard to patch away, which is exactly why the fix has to be structural rather than just a reminder email telling staff to be careful. Moving advertising-account access to phishing-resistant authentication, and training teams to treat any unexpected login popup as suspicious by default, closes the specific gap this campaign is built to exploit.
FAQ: Fake ChatGPT, Gemini, and Claude Ad Portals
What is the fake ChatGPT, Gemini, and Claude ad portal phishing campaign?
It is a phishing operation detailed by Island researchers and reported by The Hacker News on October 6, 2026, that uses fake advertising and analytics websites impersonating ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus to steal login credentials and MFA codes from advertising-account administrators.
What is browser-in-the-browser (BitB) phishing?
BitB is a phishing technique that draws a fake browser popup window, complete with a fake address bar, inside a webpage the victim is already viewing, rather than opening a real separate browser window. The real browser’s address bar still shows the attacker’s domain, but most victims never check it.
Which AI brands are being impersonated?
Reporting identifies six: ChatGPT (OpenAI), Gemini (Google), Claude (Anthropic), Perplexity, Meta Muse, and Manus.
Is this campaign confirmed to use Google Ads or Meta Ads to distribute the fake sites?
No. Current reporting does not confirm a specific advertising platform used to distribute the malicious listings, and it would be inaccurate to state that it has been confirmed.
How many victims or how much money has been lost?
Current public reporting does not disclose a verified victim count, number of compromised accounts, or financial loss figure tied to this campaign.
Can MFA codes really be stolen through this attack?
Yes. Because a live operator controls the fake login flow, they can request an SMS code, an authenticator-app code, a Google approval prompt, or an Okta push approval directly from the victim and use it immediately against the real account.
What is the best defense against browser-in-the-browser phishing?
Phishing-resistant authentication such as passkeys or FIDO2 hardware security keys, since both are cryptographically bound to the real domain and cannot be captured or replayed through a fake popup window the way a typed password or one-time code can.
Has OpenAI, Google, or Anthropic confirmed a breach of their own systems?
No. Current reporting describes impersonation of these companies’ AI brands by a third-party phishing operation, not a confirmed breach of OpenAI’s, Google’s, or Anthropic’s own infrastructure.
Related Coverage
- ChatGPT vs Gemini vs Perplexity Deep Research: 15x [2026]
- DeepSeek vs Haiku 5.5 vs Gemini Flash: 7.5x Gap [2026]
- Gemini Argon's 1M-Token Debut Triggers Free-Tier Cut [2026]
- Google Squeezes Free Gemini 3 Days After Argon Debut [2026]
- Google Cuts Free Gemini to 1 Model Starting Oct. 9 [2026]
