Cybersecurity researchers have detailed a human-operated phishing platform that impersonates advertising products for major AI chatbots including OpenAI ChatGPT, Google Gemini, Anthropic Claude, Perplexity, Meta Muse, and Manus. The fake portals claim to offer campaign optimization, spend audits, and business-account connections, but are designed to steal user credentials and multi-factor authentication codes. The campaign, disclosed on October 6, 2026, targets users globally and leverages phishing portals that mimic legitimate AI advertising interfaces.

Which products are affected?

ChatGPT, Gemini, Claude, Perplexity, Meta Muse, Manus

What should defenders do?

Users should verify URLs and rely only on official sources for AI advertising platforms. Enabling phishing-resistant multi-factor authentication is recommended. Suspicious portals should be reported to the legitimate platform vendors including OpenAI, Anthropic, Google, and Meta. Awareness of the campaign and its tactics is essential for prevention.

highPhishing

Fake AI Chatbot Ad Portals Deployed to Steal Credentials and MFA Codes

Researchers uncover human-operated phishing platform mimicking advertising products for major AI chatbots

CyberIntel DeskPublished about 1 hour agoUpdated less than a minute ago1 min read

Fake AI Chatbot Ad Portals Deployed to Steal Credentials and MFA Codes

Key Takeaways

A human-operated phishing platform impersonates AI chatbot advertising products to steal credentials and MFA codes.
Fake portals mimic legitimate interfaces for ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus.
The campaign offers features like campaign optimization and spend audits as bait to lure victims.

Related Security News

highCyber Attacks

China-Aligned TA419 Conducts AitM Phishing Against U.S. AI Policy Experts

A China-nexus threat actor identified as TA419 (also tracked as FamousSparrow) has been conducting credential phishing campaigns targeting U.S. AI policy experts, think tank researchers, university academics, and legal sector personnel. The campaigns use Microsoft Account-to-Account (AitM) phishing infrastructure to bypass multi-factor authentication and harvest credentials. Threat actors impersonated prominent economists, AI policymakers, and a prominent Anthropic employee to increase the effectiveness of their lures. The activity has been ongoing through at least October 2026. Microsoft recommends enabling phishing-resistant MFA and implementing conditional access policies as primary mitigations.

The Hacker News2 days ago1 min read