Fake AI Ads Steal Accounts

Security firm Island has disclosed a phishing campaign where cybercriminals use fake AI-powered marketing tools branded with names like ChatGPT, Gemini, and Claude to target advertising agencies and media buyers.

The attackers deploy an advanced browser-in-the-browser (BitB) platform. When victims click "connect," the tool renders a full fake browser interface, including the address bar, within the actual browser window. This tricks users into believing they are on legitimate domains like accounts.google.com. The kit adapts its UI to match the victim's operating system and supports workflows for Google, Meta, TikTok, and Okta.

Crucially, human operators monitor the attack in real-time, deciding which MFA screens or error messages to display next, allowing them to bypass standard defenses. Since these stolen accounts often have linked payment methods and budgets, attackers can directly abuse funds or access client accounts. As of the report, the campaign remains active, with researchers observing hundreds of victim submissions.