[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH8yWoSolM7a4bvr-yx59yPP9EzgYtrFoPPaaDrPwe1I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"2a7666c9-1bfa-4c13-a31c-b4c1c7bad3b4","fake-ai-ad-portals-steal-credentials-and-mfa-codes-via-browser-in-the-browser-phishing","ae0b3ba1-2d5d-41c6-9df9-c3c7abbcd3c6","Fake AI Ad Portals Steal Credentials and MFA Codes via Browser-in-the-Browser Phishing","Attackers created convincing fake login portals impersonating ChatGPT, Gemini, and Claude advertising platforms using a browser-in-the-browser (BitB) technique, which renders a spoofed browser window inside a real one to deceive even vigilant users. This attack is particularly dangerous because it bypasses the visual trust signals users rely on — such as checking the URL bar — since the fake window mimics a legitimate browser chrome. Multi-factor authentication codes were also harvested in real time, demonstrating that SMS or TOTP-based MFA alone is insufficient against adversary-in-the-middle and phishing-proxy attacks. Compromised ad accounts were then monetized through fraudulent campaigns or sold on underground markets, amplifying downstream harm. This highlights the critical need for phishing-resistant authentication and continuous user education about emerging social engineering techniques.","**Immediate actions:**\n- Enforce phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys or hardware security keys) for all accounts, especially advertising and high-value platforms.\n- Train users to verify login portals by opening a fresh browser tab and navigating directly to the official site rather than clicking ads or pop-ups.\n- Report and block known phishing domains through your email gateway, DNS filtering, and browser security tools.\n\n**Long-term improvements:**\n- Deploy an enterprise password manager to prevent credential entry on unrecognized or spoofed domains.\n- Establish a formal phishing simulation program that includes advanced techniques like browser-in-the-browser attacks to build organizational resilience.\n- Implement conditional access policies that restrict logins to managed, compliant devices regardless of credential validity.\n\n**Detection measures:**\n- Monitor advertising accounts for anomalous spend patterns, new campaign creation, or unexpected admin changes that may indicate account takeover.\n- Enable login anomaly alerting (new geolocation, device fingerprint, or impossible travel) on all critical SaaS platforms.\n- Integrate threat intelligence feeds that flag newly registered phishing domains mimicking AI or advertising services.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST SI-3 – Malicious Code Protection","NIST PR.AT-1 – Security Awareness Training","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link","GDPR Article 32 – Security of Processing (credential data protection obligations)",{},"published","2026-10-06T22:21:47.872492+00:00","2026-10-06T22:21:47.539+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Ffake-chatgpt-gemini-and-claude-ad.html","fake-chatgpt-gemini-and-claude-ad-portals-capture-credentials-and-mfa-codes-5024a2","Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]