Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

A malicious campaign is targeting advertising account managers by creating fake websites impersonating popular AI services including ChatGPT, Gemini, Claude, and Perplexity. The attackers use browser-in-browser (BitB) attack techniques to steal login credentials and multi-factor authentication (MFA) codes. The campaign is specifically aimed at people managing advertising accounts, suggesting the goal is to hijack ad accounts for financial gain or fraudulent advertising. Browser-in-browser attacks render a fake browser window within the real browser, making phishing pages appear legitimate with convincing URLs. The stolen MFA codes allow attackers to bypass two-factor authentication protections. This campaign highlights the exploitation of AI brand recognition to lend credibility to phishing sites. Ad account takeovers can result in significant financial losses and misuse of advertising budgets.