Researchers Expose Massive Phishing Operation Using Fake AI Platform Portals to Steal Credentials and MFA Codes

Cybersecurity researchers have uncovered a sprawling phishing operation that impersonates advertising portals for leading AI platforms, deploying a sophisticated browser-in-the-browser (BitB) technique to harvest user credentials and multi-factor authentication codes in real time. The campaign, documented by Island researchers Oleg Zaytsev and Ofek Ronen, targeted fraudulent advertising management sites mimicking ChatGPT, Google Gemini, Anthropic Claude, Perplexity, Meta Muse, and Manus. Victims were lured with promises of services such as campaign optimization, spend audits, and business-account connections—features that appealed to marketers seeking to manage their advertising spend across multiple AI platforms.