[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fE1V43Vna8-iLCCoFzsvL6lVS-cTfIghd1oDTNtNunlI":3},{"article":4,"iocs":52,"watch_terms":56,"solutions":57,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"17e3f9aa-c311-4db2-81f6-6d225c9a50c4","Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes","fake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes-7a6163","A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. [...]","Attackers are running a sophisticated phishing campaign targeting advertising account managers with fake ChatGPT, Gemini, Claude, and Perplexity sites. The malicious pages leverage browser-in-browser (BitB) attacks to steal login credentials and MFA codes, with human operators controlling the flow to request passwords, SMS codes, and authenticator tokens. The campaign is part of a broader operation traced back to March 2026, using a Next.js\u002FSocket.IO infrastructure to target Google, Meta, TikTok, and Okta sign-in workflows.","Phishing campaign uses fake AI sites to steal ad account credentials and MFA codes via browser-in-browser attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F05\u002F13\u002FPhishing.jpg","2026-10-06T15:16:44+00:00","2026-10-06T16:00:17.176687+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Browser-in-Browser (BitB) Attack","technology",{"name":21,"type":22},"ChatGPT","product",{"name":24,"type":22},"Google Gemini",{"name":26,"type":22},"Claude",{"name":28,"type":22},"Perplexity",{"name":30,"type":22},"Meta Muse AI","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":31,"icon":33,"name":34,"slug":35},null,"Identity & Access","identity-access",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":46,"value":54,"context":55},"Browser-in-Browser (BitB) Phishing Kit","Multi-platform phishing kit targeting ad account credentials, supports Windows, macOS, iOS, Android with socket.io control channel",[21,24,26],{"controls":58,"vendors":139},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":89,"name":90,"problem":91,"products":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[93,98,106],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":94,"product_name":95,"url":96,"description":97},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":115,"name":116,"problem":117,"products":118},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[119,126,133],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":123,"url":124,"description":125},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":115,"product_name":130,"url":131,"description":132},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":135,"url":137,"description":138},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":155},"fake-ai-chatbot-sites-harvest-mfa-codes-via-browser-in-browser-phishing","Fake AI Chatbot Sites Harvest MFA Codes via Browser-in-Browser Phishing","Attackers are exploiting the widespread trust and popularity of AI tools like ChatGPT and Gemini to lure advertising account managers into convincing phishing sites. Using Browser-in-Browser (BitB) attacks, the campaign renders realistic fake browser windows that mimic legitimate login portals, tricking victims into surrendering not just passwords but live MFA codes to human operators in real time. This matters because even security-conscious users with MFA enabled can be compromised when the attack intercepts tokens dynamically, bypassing a control many organizations consider a strong safeguard. The targeting of high-value advertising accounts on Google, Meta, and TikTok amplifies the financial and reputational damage potential.",[145,146,147,148,149,150,151,152,153,154],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3 Authenticators)","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST AT-2 – Literacy Training and Awareness","MITRE ATT&CK T1534 – Internal Spearphishing","MITRE ATT&CK T1111 – MFA Interception","GDPR Article 32 – Security of Processing (where EU user data is at risk)",{}]