Phishing platform impersonating AI brands steals ad accounts and MFA codes
Start here
Island researchers disclose a
Generated by AI from reports · Updated 3 days ago
Progress timeline
- The Hacker NewsPhishing platform with ad portals impersonating ChatGPT, Gemini, and Claude steals credentials and MFA codes
Island researchers disclose a "human-operated phishing platform" that impersonates ad products for Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus, using browser-in-the-browser (BitB) to forge login windows and steal account credentials and MFA codes. Among them, museads.ai appeared on September 16, 2026, launching just over a week after Meta introduced Muse. Clicking the "Connect" button on the fake page triggers the BitB attack; device fingerprints are sent to /api/send/ip via Socket.IO, and attackers log in in real time and choose MFA challenges themselves. Targets include agency employees, media buyers, and manager account administrators; the related sites share the Next.js and Socket.IO technology stack.
- IslandIsland discloses phishing platform disguised as AI ad products, launching a fake site within eight days of Meta Muse's release
Island security research disclosed a human-operated phishing platform that impersonates a range of AI advertising products. The latest lure, Muse Ads, appeared shortly after Meta released Muse on September 8, 2026, and museads.ai was live by September 16. All pages revolve around the same Connect button; clicking it draws a fake browser window inside a real browser, with the address bar showing trusted sources such as accounts.google.com or Okta tenants, while the real browser remains on the phishing domain. The platform logs every password attempt, fingerprints devices, and lets operators choose the next MFA prompt in real time, supporting Google, Meta, TikTok, and Okta flows. Hundreds of victim submissions were observed during the research, and the activity was still ongoing at the time of writing. Targets are mostly ad agency personnel and manager account administrators, because ad accounts carry payment methods and budgets, and manager accounts can also reach multiple client accounts.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- 网页The RegisterBrowser-in-browser attacks use fake Meta Muse Ad lure to steal credentials(opens the original post in a new tab)
- 网页TechRadarChatGPT, Gemini, and Claude imitated in fake ads that steal credentials and MFA codes(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 7New3 sources (3 outlets,0 accounts)
- Oct 8New1 sources (1 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)