Fake ChatGPT, Gemini, Claude, and Perplexity Sites Used to Steal Advertising Accounts and MFA Codes

A new cybersecurity campaign has been identified that targets advertising professionals by impersonating popular generative AI platforms. According to reports, threat actors have created fake websites mimicking the interfaces of ChatGPT, Gemini, Claude, and Perplexity. These spoofed sites are used to steal login credentials and multi-factor authentication (MFA) codes from ad account managers.

The attack chain begins when targets are directed to fake versions of these AI platforms. The interfaces employ browser-in-browser attack techniques, which simulate pop-up browser windows to make the spoofed interface appear legitimate. This method is used to bypass MFA protections and harvest credentials entered by the victim.

The campaign specifically targets ad account managers, with the objective of gaining unauthorized access to advertising accounts. Compromised accounts could allow threat actors to manipulate ad campaigns, steal marketing assets, or conduct further fraud using the victim's established advertising presence. The exact scale of the campaign and the identity of the threat actors behind it remain unconfirmed.

Security researchers note that the browser-in-browser technique, while effective for social engineering, can be mitigated through user vigilance and the use of phishing-resistant authentication methods. Organizations are advised to train personnel responsible for advertising accounts on identifying spoofed interfaces and verifying URLs before entering credentials.