Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes

Attackers created convincing fake login portals impersonating ChatGPT, Gemini, and Claude advertising platforms using a browser-in-the-browser (BitB) technique, which renders a spoofed browser window inside a real one to deceive even vigilant users. This attack is particularly dangerous because it bypasses the visual trust signals users rely on — such as checking the URL bar — since the fake window mimics a legitimate browser chrome. Multi-factor authentication codes were also harvested in real time, demonstrating that SMS or TOTP-based MFA alone is insufficient against adversary-in-the-middle and phishing-proxy attacks. Compromised ad accounts were then monetized through fraudulent campaigns or sold on underground markets, amplifying downstream harm. This highlights the critical need for phishing-resistant authentication and continuous user education about emerging social engineering techniques.