Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

Summary

A phishing campaign uses fake ChatGPT, Gemini, Claude, and Perplexity sites, some built around Meta's Muse AI agent, to target ad account managers, media buyers, and administrators. Browser-in-the-browser (BitB) pages mimic a Google sign-in window, and a human operator steers victims through password entry, SMS or authenticator codes, Okta push requests, and QR codes to capture credentials and MFA codes. Island researchers traced the operation through shared Next.js and Socket.IO infrastructure and misconfigured public GitHub repositories, tying it to lures dating back to March.

Related items

• InfoAnthropic’s AI gave Philadelphia police a fake tip about an unsolved homicideSame vendor · The Verge (AI)
• InfoOpenAI Fires 3 Safety Researchers in Dispute Over AI RisksSame vendor · SecurityWeek
• MediumHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksSame vendor · BleepingComputer
• Info‘Pure insanity’: Mathematicians will need years to make sense of OpenAI’s latest dropSame vendor · The Verge (AI)
• InfoOpenAI reports three new incidents of misalignmentSame vendor · CSO Online