Fake AI Chatbot Ads Steal Passwords, MFA Codes

Key Takeaways

• A sophisticated phishing campaign is impersonating popular AI chatbots like ChatGPT, Claude, and Gemini through deceptive ads.
• The attackers employ convincing fake websites and use live human operators to guide victims through fraudulent login processes.
• This campaign aims to steal passwords and multi-factor authentication (MFA) codes, targeting advertising professionals.
• Compromised advertising accounts can lead to unauthorized ad spending, fraudulent campaigns, and exposure of client billing information.
• The attackers utilize a “browser-in-browser” technique to create highly realistic fake login windows, making detection difficult for unsuspecting users.

Cybercriminals are leveraging the widespread adoption of artificial intelligence by creating elaborate fake advertisements for popular AI chatbots such as ChatGPT, Claude, and Gemini. These deceptive campaigns are designed to harvest user credentials, including passwords and multi-factor authentication (MFA) codes, through highly convincing phishing tactics.

Unlike traditional malware distribution, this operation relies on sophisticated social engineering. Victims are directed to meticulously crafted imitation websites where live human operators engage them, guiding them through a series of fraudulent sign-in prompts. This interactive approach significantly enhances the campaign’s realism and success rate.

The campaign begins with invitation emails, luring advertising professionals with promises of advanced campaign planning, spending audits, and seamless account integrations. This strategy mirrors previous attacks that exploited well-known technology brands, making the credential requests appear legitimate. Research by Island.io indicates that the attackers can manipulate the login flow, rejecting incorrect passwords, selecting specific authentication challenges, and redirecting victims after successful credential capture. Island.io said in a report, detailing hundreds of observed victim submissions, with the activity ongoing as of their publication on October 6, 2026.

Sophisticated Impersonation and User Interaction

The fake AI products offer specific lures to encourage account connection. For instance, ChatGPT impersonations offer “weekly Google Ads briefings,” Gemini pages promote “manager-account support,” and Claude features its own “advertising portal.” Other prominent AI brands, including Perplexity and Manus, are also being impersonated. A new lure, “Muse Ads,” emerged by September 16, just eight days after Meta announced its legitimate Muse product. This rapid deployment demonstrates the attackers’ agility in adapting to new trends. Researchers noted that the sign-in forms and fake browser windows for Muse Ads reused existing code from the broader phishing platform, highlighting the efficiency with which new product narratives are integrated into established malicious infrastructure.

A key technique employed is the “browser-in-browser” attack. When a user clicks “Connect,” a simulated browser window appears within the legitimate browser. This inner window displays a seemingly authentic address bar and lock icon, while the actual, malicious page remains hosted on the attacker’s infrastructure. This visual deception makes it exceedingly difficult for users to discern the fraud.

The phishing interface is highly adaptive, adjusting its appearance to mimic various operating systems, including Windows, macOS, iOS, and Android. Newer versions even replicate subtle details such as dark mode, mobile browser controls, and translucent toolbars. These granular touches enhance the illusion of authenticity without altering the real browser’s URL or origin.

Behind this sophisticated facade, the platform meticulously logs victim data, including device characteristics, geographical location, and submitted credentials. It retains up to three password attempts, allowing operators to falsely claim a password failure, request a retry, and capture every input provided by the victim. Human operators then dynamically select the next authentication step, attempting real logins in the background. The system supports various MFA prompts, including SMS codes, authenticator app codes, Google approvals, QR code verification, number matching, and Okta push requests. A “waiting” screen keeps victims engaged while the attacker processes the stolen information and determines the subsequent request.

Shared Infrastructure and Account Protection

The same underlying Next.js and Socket.IO platform underpins these AI advertising phishing pages, as well as unrelated refund claim and fake recruitment sites. Researchers identified one backend server linked to 73 archived scans across 25 different domains between May 27 and June 20, demonstrating a shared infrastructure for diverse malicious campaigns. Exposed older source code from public GitHub repositories further revealed consistent routes, the three-password retry mechanism, and Telegram-based control functionalities.

The platform reconstructs login interfaces locally instead of directly proxying the identity provider’s website. This method makes the malicious traffic appear as normal application activity, evading detection by some security measures.

Compromised advertising accounts pose a significant risk, as they can be used to fund fraudulent advertising campaigns, or be sold on underground markets. Island.io warns that attackers might add their own administrators and diminish the legitimate owner’s access, prolonging the recovery process for weeks or even months. Furthermore, recruitment-themed lures present a distinct threat: employees who use corporate credentials when applying for external jobs could inadvertently expose their employer’s email, files, and business applications to unauthorized access.

What You Should Do

• Verify Authenticity: Always verify unexpected beta programs, advertising tools, or account connection requests by visiting the official vendor’s website directly, rather than clicking links in emails or ads.
• Inspect the Address Bar: Pay close attention to your browser’s outermost address bar. Do not rely on address bars or lock icons displayed within a web page, as these can be faked using “browser-in-browser” techniques.
• Implement Phishing-Resistant MFA: Organizations should prioritize the adoption of phishing-resistant authentication methods like passkeys and hardware-backed security keys (e.g., FIDO2/WebAuthn) to reduce reliance on easily intercepted passwords and codes.
• Monitor for Anomalies: Security teams should actively monitor for device-profiling requests, repeated password entry attempts, and operator-control events within their network traffic.
• Post-Compromise Audit: If an account is suspected of compromise, administrators must conduct a thorough review of not only the initial account but also all connected client accounts. Look for unfamiliar administrators, altered recovery details, and any unauthorized campaigns or spending.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.