[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnr0xg35sDdRLPzsOLkLqh6GiAFS1DC9ln4lilOoR8C4":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"ae0b3ba1-2d5d-41c6-9df9-c3c7abbcd3c6","Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes","fake-chatgpt-gemini-and-claude-ad-portals-capture-credentials-and-mfa-codes-5024a2","Cybersecurity researchers have disclosed details of a \"human-operated phishing platform\" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The products, which claim to offer campaign optimization, spend audits, and business-account connections, are designed with one goal in","Cybersecurity researchers have uncovered a sophisticated phishing platform that impersonates advertising products for popular AI chatbots like ChatGPT, Gemini, and Claude. The platform uses a browser-in-the-browser technique to create spoofed login windows, capturing user credentials and multi-factor authentication codes. The attackers aim to monetize stolen ad accounts by running their own campaigns or selling them.","Phishing platform impersonates AI chatbot ad portals to steal credentials and MFA codes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Ffake-chatgpt-gemini-and-claude-ad.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiOD8Nta3AzEJA8JDouSAdwr3Obls6VzxBZwHHerzX0eZDKBTqWzVrAmZbX8VrvxKN1QNooX5GVAahBTaqPkWWcqRCO12MDDHWjboFPyw5FU1BaH07_wQhZkUNOROwHLFneZKKBY8oxjPTs0CpBF52UrLjeloGDwolt4udNn-ojCQNvvGvmo1TXdS3wNJlw\u002Fs1600\u002Fmuse.png","2026-10-06T18:38:55+00:00","2026-10-06T22:00:28.182576+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"ChatGPT","product",{"name":21,"type":19},"Gemini",{"name":23,"type":19},"Claude",{"name":25,"type":19},"Muse",{"name":27,"type":19},"Perplexity",{"name":29,"type":19},"Meta Muse","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},[49],{"type":50,"value":51,"context":52},"domain","museads.ai","Example domain used for AI ads phishing campaign",[18,21,23],{"controls":55,"vendors":141},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":86,"name":87,"problem":88,"products":89},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":115,"name":116,"problem":117,"products":118},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[119,127,134],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":115,"product_name":131,"url":132,"description":133},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":135,"product_name":138,"url":139,"description":140},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":157},"fake-ai-ad-portals-steal-credentials-and-mfa-codes-via-browser-in-the-browser-phishing","Fake AI Ad Portals Steal Credentials and MFA Codes via Browser-in-the-Browser Phishing","Attackers created convincing fake login portals impersonating ChatGPT, Gemini, and Claude advertising platforms using a browser-in-the-browser (BitB) technique, which renders a spoofed browser window inside a real one to deceive even vigilant users. This attack is particularly dangerous because it bypasses the visual trust signals users rely on — such as checking the URL bar — since the fake window mimics a legitimate browser chrome. Multi-factor authentication codes were also harvested in real time, demonstrating that SMS or TOTP-based MFA alone is insufficient against adversary-in-the-middle and phishing-proxy attacks. Compromised ad accounts were then monetized through fraudulent campaigns or sold on underground markets, amplifying downstream harm. This highlights the critical need for phishing-resistant authentication and continuous user education about emerging social engineering techniques.",[147,148,149,150,151,152,153,154,155,156],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST SI-3 – Malicious Code Protection","NIST PR.AT-1 – Security Awareness Training","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link","GDPR Article 32 – Security of Processing (credential data protection obligations)",{}]