Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Summary: Island researchers disclosed a human-operated phishing platform that impersonates advertising products for Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus, using browser-in-the-browser fake login windows to capture credentials and MFA codes. One site, museads.ai, appeared on September 16, 2026, about a week after Meta launched Muse, and the platform fingerprints victim devices, sends data to an /api/send/ip endpoint over Socket.IO, and lets an operator choose which MFA challenge the victim sees next. The campaign targets agency staff, media buyers, and manager-account administrators, and shares a Next.js and Socket.IO stack with Google Ads refund and recruitment-themed sites for Tesla, Louis Vuitton, Nike, and Adecco.
What you should know: Attackers who take an ads account add their own administrators and downgrade the legitimate owner, and Island says recovery can take weeks or months while the account keeps serving ads - and for a manager account, the damage reaches the agency's clients.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026