Fake AI Ad Portals Steal Credentials and MFA Codes via Browser-in-the-Browser Phishing
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers created convincing fake login portals impersonating ChatGPT, Gemini, and Claude advertising platforms using a browser-in-the-browser (BitB) technique, which renders a spoofed browser window inside a real one to deceive even vigilant users. This attack is particularly dangerous because it bypasses the visual trust signals users rely on — such as checking the URL bar — since the fake window mimics a legitimate browser chrome. Multi-factor authentication codes were also harvested in real time, demonstrating that SMS or TOTP-based MFA alone is insufficient against adversary-in-the-middle and phishing-proxy attacks. Compromised ad accounts were then monetized through fraudulent campaigns or sold on underground markets, amplifying downstream harm. This highlights the critical need for phishing-resistant authentication and continuous user education about emerging social engineering techniques.
Tactical Insight
Immediate actions
- Enforce phishing-resistant MFA (e.g., FIDO2/passkeys or hardware security keys) for all accounts, especially advertising and high-value platforms.
- Train users to verify login portals by opening a fresh browser tab and navigating directly to the official site rather than clicking ads or pop-ups.
- Report and block known phishing domains through your email gateway, DNS filtering, and browser security tools.
Long-term improvements
- Deploy an enterprise password manager to prevent credential entry on unrecognized or spoofed domains.
- Establish a formal phishing simulation program that includes advanced techniques like browser-in-the-browser attacks to build organizational resilience.
- Implement conditional access policies that restrict logins to managed, compliant devices regardless of credential validity.
Detection measures
- Monitor advertising accounts for anomalous spend patterns, new campaign creation, or unexpected admin changes that may indicate account takeover.
- Enable login anomaly alerting (new geolocation, device fingerprint, or impossible travel) on all critical SaaS platforms.
- Integrate threat intelligence feeds that flag newly registered phishing domains mimicking AI or advertising services.