Fake AI Ad Tools Are Stealing Logins and MFA Codes: How to Spot the Trick Before You Click "Connect"
On October 6, 2026 The Hacker News reported on research from security company Island, whose researchers Oleg Zaytsev and Ofek Ronen traced a phishing operation built around fake AI advertising tools. The pages imitate ChatGPT, Gemini, Claude, Perplexity, Manus, and Meta's Muse. Island's own write-up counts more than 100 phishing domains and hundreds of victim submissions, with the earliest sightings in May and activity continuing through this week.
A second outlet, Cyber Press, describes the same mechanics and the same numbers. Nobody disputes the basic picture.
Who Is Actually Being Targeted
Be clear on this part, because the headlines can make it sound like every ChatGPT user is at risk. Island says the primary targets are advertising professionals: agency staff, media buyers, and people who administer manager accounts that control company ad budgets. Victims arrive through invitation emails pointing to a fake "beta" product page.
If you run Facebook or Google ads for a small business, that description may be you. If you don't, the technique still matters, because it works on any login that says "Sign in with Google."
How the Trick Works
The victim lands on a convincing fake AI ad tool and clicks a "Connect" button. Here is what happens next, according to Island:
A fake browser window appears inside the real page. It has its own address bar, a lock icon, and the text "accounts.google.com."
The victim types their email and password into that fake window.
The page quietly records device details such as IP address, location, and screen size.
A human operator watches the submission come in on a dashboard.
The operator can reject the password, ask for a specific kind of MFA code, or trigger a fake approval screen.
Every code the victim types is captured and used immediately.
This technique is called browser-in-the-browser. The key detail is step 5. Cyber Press notes that this setup differs from typical phishing kits because it rebuilds the login screens itself and lets a live person steer each session. That is why the usual comfort of "I have two-factor authentication on" doesn't help here. A six-digit code is only protection if the attacker can't use it within seconds. A person sitting at a dashboard can.
The Timing Is the Real Lesson
Island reports that Meta's Muse launched on September 8, and a fake "Muse Ads" page appeared on September 16. That is eight days.
My take: every hyped AI launch now opens a phishing window. Attackers don't need to invent a lure. They wait for the news cycle to create one, then send invitations to a "beta" or "advertiser program" that sounds like the next logical step. Having built payment software for years, I think of this as a trust problem. The only trustworthy signal is the browser's real address, not anything a webpage draws for you. As Island puts it, a page can draw an address bar, a lock icon, or a security dialog, but it cannot change the real browser origin.
What This Means for Everyday Users
You don't need to be an ad buyer to use these habits. Run through this before you connect any new AI tool to a Google, Meta, or work account:
Go to the tool yourself. Don't follow an emailed invite to a beta. Type the vendor's address or use a bookmark you made earlier.
Check the real address. Look at the actual address bar at the top of your browser window, not the one inside the page.
Be suspicious of repeated password prompts. A login that rejects a correct password and asks again is a red flag in this campaign.
Treat codes as live ammunition. Never type an SMS or authenticator code into a page you reached from an email.
Use passkeys where you can. Island recommends origin-bound passkeys, which only work on the real site and can't be handed to a fake one.
Audit your ad accounts. If you manage ads, look for unfamiliar managers, changed recovery details, or campaigns you didn't approve.
Prompts You Can Try Today
Don't paste real passwords, codes, or full account numbers into any of these.
Check a suspicious invite:
I received an email inviting me to join a beta of an AI advertising tool. I will paste the text of the email below with any personal details removed. Go through it line by line and list every red flag, such as urgency, odd sender details, vague branding, or a request to connect an account. Then tell me how to verify the offer through the company's official website instead of the email.
[PASTE EMAIL TEXT]Make a passkey plan:
I use [Google / Facebook / Microsoft] for most of my accounts on [iPhone / Android / Windows / Mac]. Walk me through switching to passkeys step by step in plain language. Tell me what I should do first, what could go wrong, and how to keep a backup way to get in if I lose my phone.Mistakes to Avoid
Trusting a lock icon or a familiar web address inside a page. A page can draw both.
Assuming MFA stops everything. It doesn't when a live operator relays your codes.
Clicking "Connect" because a launch is in the news. Fake pages appear days after real announcements.
Reusing one login for everything. A stolen Google login can expose every account tied to it.
Skipping the account audit after a close call. If you entered anything on a suspicious page, change your passwords and review account permissions right away.
This campaign is aimed at advertisers, but the lesson is for anyone who clicks "Connect." Slow down at the login screen, go to the tool yourself, and let the browser's real address tell you where you are.
Sources:
Comments