Fake ChatGPT and Gemini ad tools bait users with bogus login windows

A phishing campaign impersonating AI advertising tools from ChatGPT, Gemini, Claude, and other brands uses fake browser windows and live operators to steal login credentials and guide victims through multifactor authentication.

Island researchers Oleg Zaytsev and Ofek Ronen uncovered the platform and linked its advertising lures to refund scams and fake recruitment sites. They observed hundreds of victim submissions, with activity continuing when the report was written, though that figure does not establish how many accounts were compromised.

The campaign targets agency employees, media buyers, and advertising manager-account administrators. These accounts are valuable because they control advertising budgets and stored payment methods, while a single manager account can provide access to multiple clients.

Fake Muse page
Island

A convincing product conceals the trap

Each fraudulent website presents a different business proposition. ChatGPT-themed pages promise weekly Google Ads briefings, Gemini lures advertise manager-account and linked-client support, and Perplexity pages offer campaign planning and spending audits.

The newest lure, hosted at museads[.]ai, appeared by September 16, eight days after Meta introduced its Muse personal AI agent. It promoted a supposed AI advertising manager and invited visitors to connect their advertising accounts.

All these pitches converge on a “Connect” button. Clicking it displays a fabricated browser window inside the webpage, with a trusted-looking address such as accounts.google.com and a lock icon, while the actual browser remains on the phishing domain.

Known as browser-in-the-browser phishing, the technique makes an attacker-controlled form resemble a legitimate sign-in window. The platform adapts its appearance to Windows, macOS, iOS, and Android, including mobile browser toolbars and dark mode.

Clicking Connect will trigger the BitB attack flow
Island

Operators control the authentication flow

Behind the interface, the platform collects device information, including IP address, location, screen dimensions, and WebGL details. It also retains up to three password attempts, allowing operators to reject an entry and request another without losing earlier submissions.

Using Socket.IO communications, an attacker can hold a victim on a waiting screen, request SMS or authenticator codes, display Google approval or number-matching prompts, and present Okta authentication challenges while attempting to log in in real time.

Overview of the phishing attacks
Island

The researchers stress that the visible platform recreates login interfaces locally and collects credentials through its own APIs, rather than transparently relaying an identity provider’s website through a reverse proxy.

The same Next.js and Socket.IO stack powers advertising, refund, and recruitment lures. One Railway backend appeared in 73 archived scans across 25 page domains between May 27 and June 20, linking AI advertising pages to refund scams and a fake Louis Vuitton careers site.

Recruitment variants also impersonate Tesla, Nike, and Adecco. Applicants who submit workplace Google or Okta credentials could expose their employer’s email, files, and connected applications.

Island recommends verifying AI integrations through vendors’ official websites and checking the real browser address bar before signing in. Origin-bound passkeys and hardware-backed authentication can protect against credential harvesting.