- October 7, 2026
- Posted by: administrator
- Category: AI
Cybersecurity researchers have disclosed details of a “human-operated phishing platform” that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus.
The products, which claim to offer campaign optimization, spend audits, and business-account connections, are designed with one goal in mind: to capture credentials and multi-factor authentication (MFA) codes via spoofed login windows using the browser-in-the-browser (BitB) trick.
“Each product was built around the same action: Connect,” Island researchers Oleg Zaytsev and Ofek Ronen said in a report shared. “Clicking it opened a browser drawn inside the real browser. The fake address bar displayed trusted origins such as accounts.google.com or an Okta tenant, while the real browser remained on the phishing domain.”
“Behind the interface, the platform kept every password attempt, fingerprinted the device, and let an operator pick which MFA challenge the victim saw next.”
One of the websites in question is “museads.ai,” which emerged on September 16, 2026, a little over a week after Meta launched Muse, its AI agent designed for personal workflows. Described as “Your AI ads manager for paid media workflows,” the platform claimed to help customers reach buyers, connect their ad accounts, and run sponsored placements.
Prominently placed in the spoofed web page is a Prompt Box with a “Connect” button, clicking which triggers a BitB attack to capture a visitor’s account credentials for Google, Meta, TikTok, and Okta workflows. This is accomplished by drawing a fake window displaying a bogus account sign-in form with the address bar pointing to a legitimate domain (e.g., accounts.google[.]com).
In the background, the victim’s device is fingerprinted, and the information is transmitted to the attacker at the endpoint “/api/send/ip” over Socket.IO, after which operator commands and victim data are exchanged based on the login workflow. Armed with the account credentials, the attacker attempts to sign in to the account in real-time.
Commands to the phishing page are delivered through two Socket.IO events named operator-command and telegram-command. These commands drive the sign-in process, while the human operator can view what steps the victims are taking and decide the next course of action.
“In the inspected code, both pass the received command text to the same parser, so they don’t represent separate sets of page actions,” Zaytsev, Lead Security Researcher at Island, told.
“The commands let the operator steer the victim through authentication in real time: request another password (/password), show an SMS or authenticator challenge (/2fa, /authApp), display Google prompts such as approval, QR, or number matching (/googlePrompt, /googleQrVerify, /verifyTap), or select Okta username, password, SMS, push, authenticator, and number-matching screens (/oktaUsername, /oktaPassword, /oktaSms2fa, /oktaApprove, /oktaAuthApp, /oktaVerifyTap). The operator can also reject a submitted code (/wrong2fa), keep the visitor waiting, or end or suppress the flow (/done, /ban).”
“Every brand gets its own pitch,” the researchers explained. “ChatGPT promises a Monday Google Ads brief. Gemini promises MCC (manager account) and linked-client support. Claude gets its own advertising portal, Perplexity offers campaign planning and spend audits, and Manus offers a private Meta integration.”
Users are assessed to be directed to these landing pages via fake invitation emails that impersonate these trusted brands to lend the attacks a veneer of legitimacy.
“Each one in this campaign poses as a believable product, with its own brand, pitch, and sign-in flow,” the researchers pointed out. “They also move with the news.”
Island said the AI ads pages are part of a broader phishing platform that supports a three-pronged operation, the two others being Google Ads-themed refund claims and payment confirmation, as well as recruitment-related sites for Tesla, Louis Vuitton, Nike, and Adecco.
NOTE:: We are using it for educational or Information purpose only