{"data":{"id":"40817b0f-07f2-4c66-bac3-def2b0fb559a","title":"Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes","summary":"A phishing campaign uses fake ChatGPT, Gemini, Claude, and Perplexity sites, some built around Meta's Muse AI agent, to target ad account managers, media buyers, and administrators. Browser-in-the-browser (BitB) pages mimic a Google sign-in window, and a human operator steers victims through password entry, SMS or authenticator codes, Okta push requests, and QR codes to capture credentials and MFA codes. Island researchers traced the operation through shared Next.js and Socket.IO infrastructure and misconfigured public GitHub repositories, tying it to lures dating back to March.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://www.bleepingcomputer.com/news/security/fake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes/","publishedAt":"2026-10-06T15:16:44.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedVendors":["OpenAI","Google","Anthropic","Perplexity","Meta"],"affectedVendorsRaw":["ChatGPT","Gemini","Claude","Perplexity","Muse AI agent","Meta"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"patchAvailable":null,"disclosureDate":"2026-10-06T15:16:44.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}