Fake ChatGPT and Gemini Sites Target Ad Account Managers with Phishing Attacks

Attackers Target Ad Managers with Fake AI Sites

Researchers have uncovered a phishing campaign that uses fake versions of popular AI chatbot sites like ChatGPT, Gemini, Claude, and Perplexity to steal advertising account credentials and multi-factor authentication (MFA) codes. The campaign is designed to trick agency staff, media buyers, and administrators who manage valuable advertising accounts for companies and their clients. These accounts can be used to run fraudulent ad campaigns or resold to other criminals for profit. BleepingComputer↗ (opens in a new tab) The Hacker News↗ (opens in a new tab)

How the Phishing Attack Works

The phishing sites pose as AI tools that promise to help advertisers with campaign planning, ad briefs, and account audits. To access these features, users are prompted to connect their advertising accounts. When they click the "connect" button, a fake login window appears inside the real browser. This window closely mimics a legitimate Google or Okta login popup, complete with a convincing address bar and interface. The technique, known as "browser-in-the-browser" (BitB), was first described by researcher mr.dox in 2022. It uses an iframe to display a fake login form, making it difficult for users to spot the scam.

The phishing platform adapts its appearance to different operating systems and browsers, even supporting dark mode. Once a victim enters their credentials, a human operator takes over, guiding them through further steps. The attacker may request passwords multiple times, ask for MFA codes from SMS or authenticator apps, or display approval prompts. The operator can reject codes, keep victims waiting, or end the session at any time. This hands-on approach increases the chances of bypassing security measures and gaining full control of the account.

The Broader Operation and Infrastructure

Researchers at Island, a browser security company, found that the campaign is part of a larger operation. The same infrastructure is used for other scams, including fake recruitment offers and refund pages. The phishing sites share a common technology stack, using Next.js and Socket.IO, and many are hosted on platforms like Vercel, Railway, or Render. The attackers accidentally exposed older versions of their source code on public GitHub repositories, allowing researchers to trace the operation back to March 2026.

The campaign uses dozens of URLs and targets multiple brands, including Google, Meta, TikTok, and Okta. Each fake site is tailored to the brand it impersonates, with its own marketing pitch and sign-in flow. Victims are typically lured through fake invitation emails that appear to come from trusted brands. According to Island, the Telegram channel used to control the attacks has received hundreds of victim submissions, but it is unclear how many accounts were actually compromised.

What Victims and Defenders Should Do

For victims, the immediate risk is unauthorised access to their advertising accounts. Attackers often add their own administrators and downgrade the legitimate owner, making recovery difficult and time-consuming. In some cases, the damage can extend to clients managed under the same account. Businesses are advised to use phishing-resistant authentication methods, regularly review account permissions, and be cautious about connecting accounts to new AI tools or responding to unexpected invitations.

Security teams should educate staff about BitB phishing techniques and encourage them to check for signs of fake login popups, such as the inability to move or resize the window. Reviewing logs for unusual sign-in activity and monitoring for changes in account permissions can help detect and respond to compromises early.

The Scale and Impact of the Campaign

The campaign does not exploit vulnerabilities in ChatGPT, Google, or other AI platforms. Instead, it relies on social engineering and convincing imitations to trick users. Over a three-month period, researchers observed about 850 paid-ad landings and dozens of lookalike destinations. The theft of advertising accounts is a growing problem, with attackers draining business budgets and selling accounts with good reputations on underground markets. Recovery can take weeks or months, and the financial and reputational damage can be significant.

What Happens Next

At the time of writing, there are no statements from Google, OpenAI, Meta, or law enforcement about this campaign. The story is based on independent security research and has not yet been confirmed by the affected vendors. As phishing attacks continue to evolve, organisations should remain vigilant and update their defences against new techniques like browser-in-the-browser attacks.