TL;DR
- Researchers at Island exposed a phishing platform impersonating ChatGPT, Gemini, Claude, Perplexity, Meta Muse and Manus as fake advertising tools.
- Each fake site uses a browser-in-the-browser attack to steal ad account credentials and MFA codes in real time.
- A human operator steers victims through authentication, choosing which challenge to show and rejecting submitted codes.
- The campaign targets agency staff, media buyers and manager-account administrators.
- Island recommends phishing-resistant authentication, reviewing advertising control changes, and checking AI integrations before connecting accounts.
If your brokerage runs Google or Meta ads for leads, whoever signs in to that ad account is the target.
Researchers Oleg Zaytsev and Ofek Ronen at Island published a detailed breakdown of a phishing platform that impersonates AI advertising products to capture ad account credentials and MFA codes. The full report was shared with The Hacker News. You can read the original coverage at The Hacker News.
How does the attack actually work?
Each fake product, branded as a ChatGPT ads manager, a Gemini MCC tool, a Claude advertising portal, a Perplexity campaign planner or a Manus Meta integration, is built around a single button labelled "Connect". Clicking it triggers a browser-in-the-browser (BitB) attack. The browser draws a fake sign-in window inside the real browser window, with an address bar showing a trusted origin such as accounts.google.com or an Okta tenant. The visitor is still on the phishing domain; they just cannot tell.
Behind the interface, the platform fingerprints the device and transmits data to the attacker. A human operator then watches what the victim does and issues commands through Socket.IO events to steer the sign-in flow. The operator can request another password, show an SMS or authenticator challenge, display Google approval prompts, or reject a submitted MFA code and ask for another. The attacker attempts to sign in to the real ad account in real time while the victim is still interacting with the fake window.
Island's researchers noted that all identified sites share the same technology stack, Next.js and Socket.IO, and communicate with the same endpoints. Earlier versions of the platform's source code were exposed through misconfigured public GitHub repositories.
Who is being targeted and why is an ad account worth stealing?
The campaign is aimed at agency staff, media buyers and manager-account administrators. The likely goal is to monetise stolen ad accounts by running the attackers' own campaigns or selling accounts with a clean spend history in underground markets.
Island's assessment of the damage is worth quoting directly from the source: getting a stolen ad account back can take weeks or months while it keeps serving ads. Attackers typically add their own administrators and downgrade the legitimate owner. For a manager account, the damage reaches the agency's clients.
A Mimecast report published in July 2026 is cited in the Island research, noting that malware families including VietCredCare, DuckTail, NodeStealer and PXA Stealer have made ad account theft a widespread commodity crime in the advertising ecosystem.
For a mortgage brokerage, the exposure is specific. If you run Google Ads or Meta campaigns to generate enquiries, someone on your team has credentials to that ad account. That person is the target. The fake sites arrive via invitation emails impersonating trusted AI brands, so the initial lure looks plausible to a busy staff member.
What should a brokerage actually do?
Island's recommendations are practical and do not require a security team to implement.
Use phishing-resistant authentication. Standard TOTP codes and SMS can be intercepted by this platform in real time. Hardware keys or passkeys bound to the device cannot be replayed by an operator watching a fake window.
Review advertising control changes. If an attacker gains access to your ad account, one of the first moves is to add their own administrator. Periodic audits of who has admin access to your Google Ads or Meta Business Manager accounts will surface unauthorised additions before the damage compounds.
Scrutinise AI integrations before connecting accounts. The entire attack surface here is the "Connect" button. Any new tool asking you to connect an ad account, a Google account or an Okta tenant should be verified against the vendor's official domain before you click anything. The fake sites move quickly: one site, museads.ai, appeared on 16 September 2026, a little over a week after Meta launched Muse.
This is not an isolated campaign. Island also found that threat actors are abusing Google-sponsored results to route users to attacker-authored AI chat content, which then redirects them to fake Cloudflare verification pages delivering NetSupport RAT. Across a three-month observation period ending in August 2026, the broader delivery cluster included around 850 paid-ad landings and 26 lookalike ChatGPT destinations.
The pattern here connects to a broader set of credential risks we have covered previously. The French tax data theft via stolen staff passwords case showed how a single compromised login cascades through an organisation. The browser extension hijack post covered a related vector where the attack lives inside the browser itself rather than a fake window drawn over it. Both are worth reviewing alongside this one.
The practical takeaway is narrow and actionable. Audit who has admin access to every ad account your brokerage controls. Enable phishing-resistant authentication on those accounts. Treat any unsolicited email offering to connect an AI advertising tool as a phishing attempt until proven otherwise.
FAQs
What is a browser-in-the-browser attack?
A browser-in-the-browser attack draws a fake browser window inside the real browser, complete with a spoofed address bar showing a trusted domain. The victim believes they are signing in to a legitimate site, but all credentials are captured by the attacker's platform.
Why would a mortgage broker's ad account be targeted?
Ad accounts with a clean spend history are valuable in underground markets. Attackers can run their own campaigns on your budget or sell the account. A brokerage running Google or Meta ads for lead generation holds exactly the kind of account this campaign is after.
Can MFA protect an ad account from this attack?
Standard MFA codes, SMS or TOTP, can be intercepted in real time by the human operator running this platform. The operator can request a code, receive it from the victim, and use it immediately. Phishing-resistant methods such as hardware keys or passkeys bound to the device are not replayable in this way.
How do victims reach these fake sites?
Island found that victims are directed to the landing pages via fake invitation emails impersonating trusted AI brands. The emails are designed to look like legitimate product invitations, lending the attack credibility.
What is the first thing to check if you suspect your ad account has been compromised?
Island's research indicates that attackers typically add their own administrators and downgrade the legitimate owner. The first check is the administrator list in your Google Ads or Meta Business Manager account. Remove any unrecognised accounts immediately and contact the platform's support to begin recovery.
Originally published at theautomate.io.
Top comments (0)