Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

This threat involves a phishing campaign that leverages counterfeit versions of popular AI service websites (ChatGPT, Gemini, Claude, Perplexity) to trick ad account managers into submitting their login credentials and MFA codes. The attackers use browser-in-browser attacks, a technique where a malicious webpage simulates a legitimate browser window within the browser itself, to capture sensitive authentication data. This method facilitates the theft of both passwords and MFA tokens, increasing the likelihood of successful account compromise.

Successful exploitation results in the theft of advertising account credentials and MFA codes, potentially allowing attackers unauthorized access to ad management platforms. This can lead to unauthorized ad spend, account takeover, and misuse of advertising resources. The campaign targets individuals managing advertising accounts, increasing the risk of financial and reputational damage to affected organizations.

No official patch or vendor advisory is available for this social engineering campaign. Mitigation focuses on user awareness and training to recognize phishing sites and browser-in-browser attacks. Organizations should enforce strict verification of URLs, encourage the use of hardware-based MFA tokens where possible, and consider implementing browser security features that detect or block browser-in-browser techniques. Monitoring for suspicious login activity and promptly reporting suspected phishing attempts are also recommended.