Cybersecurity researchers have uncovered a coordinated phishing effort designed to compromise advertising professionals through counterfeit versions of popular AI platforms. The campaign creates fake interfaces for ChatGPT, Gemini, Claude, and Perplexity, then deploys browser-in-browser (BitB) attacks to extract login credentials and MFA codes from victims.
The operation specifically targets agency staff, media buyers, and account administrators whose credentials provide access to multiple client accounts downstream. Compromised accounts enable attackers to either drain available advertising budgets on fraudulent campaigns or sell the accounts to other threat actors for profit.
Researchers discovered that the phishing scheme exploited the recent rollout of Meta's Muse AI agent, which the company positions as a personal task assistant. The fake AI sites promise to help advertisers identify buyers, generate ad briefs, and manage campaign audits and spending analysis.
To access these purported features, users are prompted to connect their accounts. When clicked, the "connect" button displays what appears to be a legitimate Google login window, complete with an address bar displaying accounts.google.com. In reality, this is a fabricated interface designed to harvest credentials.
How Browser-in-Browser Attacks Work
BitB is a phishing technique first documented by cybersecurity researcher mr. dox in March 2022. The method involves embedding a fake browser window inside a legitimate webpage to present a convincing login prompt. The fraudulent window mimics authentic login pop-ups, complete with realistic titles, UI elements, and the URL the user expects to see. However, the fake window is merely an iframe programmed to intercept and transmit credentials.
The technique has proven effective against various targets over the years, including Steam account holders. In this campaign, researchers at Island, a browser security firm, identified that attackers deployed a toolkit that adapts the phishing interface across Windows, macOS, iOS, and Android platforms, with support for browser-specific styling and dark mode.
Once a victim enters the BitB flow, a human operator assumes control of the interaction. The attacker can request password entry multiple times, solicit SMS or authenticator codes to circumvent MFA, display Okta push notifications, show Google approval screens, or present QR codes. Operators retain the ability to reject submitted codes, place victims in holding screens, or terminate the phishing sequence at their discretion.
Infrastructure and Scope of the Operation
Analysis of the campaign's underlying infrastructure revealed this phishing effort is part of a much larger operation employing multiple deception tactics. Beyond the AI impersonation lures, the attackers have used fake job postings and counterfeit refund pages to compromise victims.
All pages connected to the operation share a common technology stack built on Next.js and Socket.IO, utilize shared API endpoints, and frequently employ Vercel for frontend hosting with Railway or Render as backend services. The attacker inadvertently exposed older source code through misconfigured public GitHub repositories, enabling researchers to trace the campaign's origins back to March.
A Telegram control channel associated with the attacks received hundreds of victim submissions, though this figure may not represent the total number of successfully compromised accounts. The phishing platform supports authentication workflows for Google, Meta, TikTok, and Okta, with commands transmitted via Socket.IO events.
Island researchers noted that the platform rebuilds provider interfaces locally and collects credentials and MFA state through its own APIs, rather than using a transparent reverse-proxy approach. This design choice masks the traffic flow, making communications appear to originate from an AI product interacting with an unrelated application backend.
Detection and Mitigation
Despite their sophistication, BitB attacks contain inherent technical limitations that can expose them. Unlike legitimate OAuth pop-ups generated by real browsers, iframes cannot be moved outside the browser window or resized—basic operations that genuine browser windows support.
The researchers documented dozens of URLs associated with the operation across campaigns targeting advertising, refunds, and recruitment, with a comprehensive list provided in their report. According to Island's analysis, "Unlike a transparent reverse-proxy kit, the visible platform locally rebuilds the provider interface and collects credentials and MFA state through its own APIs."