> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes - URL: https://f4n6.co.uk/security-feed/fake-chatgpt-gemini-and-claude-ad-portals-capture-credentials-and-mfa-codes/ - Published: 2026-10-06T22:22:07.000Z - Updated: 2026-10-06T22:22:07.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary A human-operated phishing platform is impersonating advertising products for Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus, using browser-in-the-browser (BitB) fake sign-in windows to capture credentials and MFA codes in real time. Island researchers attribute the platform to a broader operation that also runs Google Ads refund and payment-confirmation lures and recruitment-themed sites for Tesla, Louis Vuitton, Nike, and Adecco, all sharing a Next.js and Socket.IO stack. The campaign targets agency staff, media buyers, and manager-account administrators, with the likely end goal of monetizing stolen ad accounts. No CVE is involved and there is no exploitation data to apply; this is a credential-phishing and account-takeover threat, not a software vulnerability. For EMEA financial services clients running paid media through agencies or in-house teams, the exposure is to Google, Meta, TikTok, and Okta credentials, and the MFA bypass is the part that matters most. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The platform captures credentials and MFA codes for Okta workflows, which is the identity layer for many financial services firms. A successful capture is an ICT-related incident requiring a managed response process. | Firms need a defined incident management process that covers identity compromise originating from a third-party ad or agency workflow, not just internal system failures. | | DORA Art. 28 | The campaign targets agency staff and media buyers, meaning the compromised identity may belong to an ICT third-party provider or its personnel rather than the firm directly. | Third-party risk assessment must extend to marketing and advertising agencies with access to corporate identity providers, and contracts should address incident notification from those providers. | | NIS2 Art. 21(2)(d) | The attack path runs through agency and media-buyer personnel who hold credentials for the firm's identity provider. | Supply chain security measures must cover the marketing and advertising supplier tier, not only technology vendors. | No CISA KEV entry, CVSS score, or exploitation state applies to this item because no CVE is involved. The regulatory rows above are engaged by the identity and third-party facts in the source, not by a vulnerability. ## 3\. Technical analysis & attack chain The platform is a credential-phishing operation built around a browser-in-the-browser (BitB) technique. It does not exploit a software flaw. It relies on a fake sign-in window drawn inside the victim's real browser, with a spoofed address bar showing a trusted origin while the real browser stays on the phishing domain. Confirmed steps, as described by Island: 1. A victim is directed to a fake advertising portal. The source states users are assessed to be directed there via fake invitation emails impersonating the trusted brands. The source does not give the sender addresses, subject lines, or sending infrastructure. 2. The portal presents a product pitch tailored to each AI brand. ChatGPT promises a Monday Google Ads brief. Gemini promises MCC (manager account) and linked-client support. Claude gets its own advertising portal. Perplexity offers campaign planning and spend audits. Manus offers a private Meta integration. 3. Each product is built around a single action: Connect. Clicking it opens a browser drawn inside the real browser. 4. The fake address bar displays trusted origins such as accounts.google.com or an Okta tenant, while the real browser remains on the phishing domain. 5. The fake window shows a bogus account sign-in form. The victim enters credentials for Google, Meta, TikTok, or Okta workflows. 6. In the background, the platform fingerprints the victim's device and transmits the data to the attacker at the endpoint /api/send/ip over Socket.IO. 7. The platform keeps every password attempt. The operator picks which MFA challenge the victim sees next, and operator commands and victim data are exchanged based on the login workflow. 8. The attacker attempts to sign in to the account in real time using the captured credentials and the MFA codes the victim supplied. The named site in the source is museads.ai, which emerged on September 16, 2026, a little over a week after Meta launched Muse. It is described as "Your AI ads manager for paid media workflows" and claims to help customers reach buyers, connect ad accounts, and run sponsored placements. Infrastructure and tooling: all identified websites share the same technology stack, Next.js and Socket.IO, and communicate with the same endpoints. The operators exposed source code for earlier versions of the platform through misconfigured public GitHub repositories. The source does not name the repositories, the hosting provider, or the full endpoint list beyond /api/send/ip. Targeting: agency staff, media buyers, and manager-account administrators. The assessed end goal is monetizing the ads accounts, either by running the attackers' own campaigns or selling accounts with clean spend history. Related context from Microsoft: AI-brand impersonation is a broader pattern. Microsoft observed a ChatGPT-themed phishing campaign on May 5, 2026 that sent 4,500 emails to targets in South Africa (97%), and the same campaign delivered as many as 100,000 emails in a single day to targets in Switzerland, Austria, and South Africa across higher education and professional services. That campaign used the sender display name ChatGPT and the subject "To ensure your ChatGPT Plus continues to work โ€“ please update your payment method", and routed clicks through grupoconstat\[.\]bitrix24\[.\]com\[.\]br (a legitimate CRM service) to awstrack\[.\]me (an Amazon tracking domain) before reaching the phishing page. Microsoft also observed the initial access broker Storm-3075 using AI-themed malvertising to deliver payloads, including malware signed by a malware-signing-as-a-service offering attributed to Fox Tempest, on behalf of multiple downstream actors. Confidence caveats. The Island findings are single-sourced in this corpus; the technical detail on BitB, the /api/send/ip endpoint, and the Socket.IO command channel comes from Island alone and should be verified before enforcement. The Microsoft material is a separate campaign set and does not confirm the Island platform's infrastructure. The Storm-3075 and Fox Tempest attributions are Microsoft's and are not linked by any source to the Island platform. No MITRE ATT&CK profile is provided for Storm-3075 or Fox Tempest in the verified reference data, so those attributions are unconfirmed for the purposes of this advisory. The source does not state that any financial services firm has been compromised. ## 4\. Mitigation & containment P1 (within 24 hours) - Block the named domain museads\[.\]ai at DNS and web proxy, and add it to email gateway URL blocklists. This is the only domain named in the source for this campaign. - Hunt identity logs for sign-ins to Google, Meta, TikTok, and Okta from sessions that began on a non-corporate domain, and for MFA challenges completed in rapid succession or from an unexpected geography. The BitB technique means the credential entry happens on the phishing domain, so the authentication event itself may look legitimate; focus on the session origin and device fingerprint change. - Force re-authentication and credential reset for any account that interacted with museads\[.\]ai or any of the other AI ads portals named in the source. - Brief agency and media-buyer contacts that fake invitation emails are being used to route them to these portals. The source does not provide sender addresses, so the warning must be behavioural: do not click Connect on an unsolicited ad-platform invitation. P2 (within 72 hours) - Review which third-party marketing and advertising agencies hold credentials to your identity provider, and whether those credentials are scoped to ad accounts only or carry broader access. The campaign targets manager-account administrators, who typically have wider reach. - Require phishing-resistant MFA (FIDO2 or passkeys) for Okta and for Google, Meta, and TikTok accounts used for paid media. The BitB technique defeats code-based MFA because the victim types the code into the attacker's fake window; it does not defeat a hardware-bound credential. - Check whether any of your ad accounts show unexplained campaign creation, spend changes, or new user additions. The source's stated end goal is monetizing accounts with clean spend history. P3 (within 7 days) - Add the Next.js and Socket.IO stack signature to web proxy inspection rules where your environment permits, and alert on outbound connections to /api/send/ip. This endpoint is single-sourced from Island; validate before enforcing. - Review public GitHub exposure for any of your own marketing or agency tooling, given the operators found earlier platform versions through misconfigured public repositories. - Extend third-party contract terms to require incident notification from marketing and advertising agencies, consistent with DORA Art. 30 key contractual provisions. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | ---------------------------------------- | ---------------------------------------------------------- | ----------------------------- | | domain | museads\[.\]ai | high | Island via The Hacker News | | url path | /api/send/ip | medium (single-sourced) | Island via The Hacker News | | domain | grupoconstat\[.\]bitrix24\[.\]com\[.\]br | medium (separate Microsoft campaign, not confirmed linked) | Microsoft Threat Intelligence | | domain | awstrack\[.\]me | medium (separate Microsoft campaign, not confirmed linked) | Microsoft Threat Intelligence | ```iocs domain museads[.]ai url hxxps://museads[.]ai/api/send/ip domain grupoconstat[.]bitrix24[.]com[.]br domain awstrack[.]me ``` The grupoconstat\[.\]bitrix24\[.\]com\[.\]br and awstrack\[.\]me domains are from the Microsoft-reported ChatGPT-themed payment phishing campaign, which is a separate operation from the Island platform. They are included because they are AI-brand phishing infrastructure, but no source links them to museads\[.\]ai. Treat them as context, not as confirmed shared infrastructure. ### Behavioural indicators | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | ----------------------- | | Sign-in to Google, Meta, TikTok, or Okta following a session that originated on a non-corporate ad-portal domain | Identity provider logs, web proxy logs | medium | | MFA challenge completed immediately after credential entry from a new device fingerprint | Identity provider logs | medium | | Outbound Socket.IO connection to /api/send/ip | Web proxy, network flow logs | medium (single-sourced) | | New campaign creation or spend change on an ad account with no corresponding internal request | Google Ads, Meta Ads, TikTok Ads audit logs | medium | ## 6\. Detection The source provides one distinctive network artefact (/api/send/ip) and one domain (museads.ai). There are no file hashes, no malware samples, and no command-line artefacts, because this is a phishing platform rather than a malware family. A YARA rule is not appropriate here: there is no file to scan. A Sigma rule for the network and identity behaviour is appropriate. ```yaml title: AI Ad Portal Phishing - Socket.IO Exfiltration Endpoint id: 8f3a2c1e-4b7d-4e9a-9c2f-1a6b5d8e3f70 status: experimental description: Detects outbound HTTP traffic to the /api/send/ip endpoint used by the fake AI advertising portal phishing platform to exfiltrate device fingerprints and victim data over Socket.IO. author: Adverse Trace date: 2026-10-06 references: - https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html logsource: category: proxy detection: selection_uri: cs-uri-stem|endswith: '/api/send/ip' selection_method: cs-method: 'POST' condition: selection_uri and selection_method falsepositives: - Legitimate applications using an /api/send/ip path on their own infrastructure. Correlate with the destination domain before alerting. level: medium ``` ```yaml title: Sign-in to Ad or Identity Platform Following Non-Corporate Ad Portal Session id: 2d9e6b4a-7c1f-4a3b-8e5d-9f0a2c6b1d84 status: experimental description: Detects a successful authentication to Google, Meta, TikTok, or Okta shortly after a user session to a non-corporate advertising portal domain, consistent with browser-in-the-browser credential and MFA capture. author: Adverse Trace date: 2026-10-06 references: - https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html logsource: product: okta service: system detection: selection_event: eventType: 'user.authentication.sso' outcome.result: 'SUCCESS' selection_app: target.displayName|contains: - 'Google Ads' - 'Meta' - 'TikTok' timeframe: 15m condition: selection_event and selection_app falsepositives: - Legitimate agency staff authenticating to ad platforms during normal work. Baseline expected source networks and device fingerprints. level: medium ``` The Sigma rules use the /api/send/ip path and the platform names exactly as they appear in the source. The domain museads\[.\]ai is defanged in ยง5 but must be entered in its live form in any proxy or DNS blocklist. ## 7\. Sources - The Hacker News, "Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes", https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html, 2026-10-06\. Primary item; reports Island research by Oleg Zaytsev and Ofek Ronen. - Microsoft Threat Intelligence, "AI brands as bait: How threat actors are using the AI hype in social engineering", https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/, 2026-06-08\. Context on AI-brand phishing, Storm-3075, and Fox Tempest. - Microsoft Threat Intelligence, "Detect and disrupt AI-themed attacks with Microsoft Defender", https://www.microsoft.com/en-us/security/blog/2026/09/10/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/, 2026-09-10\. Context on AI-themed campaign detection. ## 8\. Adverse Trace position Adverse Trace assesses this as a medium-severity credential-phishing threat with a high impact on the specific accounts it reaches. There is no CVE, no CVSS score, and no CISA KEV entry to apply, so the severity rests on the identity exposure: the platform captures both passwords and MFA codes, which means code-based MFA does not stop it. The targeting of agency staff, media buyers, and manager-account administrators puts the exposure at the boundary between financial services firms and their marketing suppliers, which is exactly the tier that DORA Art. 28 and NIS2 Art. 21(2)(d) require firms to cover. The Island technical detail is single-sourced in this corpus, so we treat the /api/send/ip endpoint and the Socket.IO command channel as medium confidence and will not recommend enforcement-grade blocking on them until a second source corroborates. The Storm-3075 and Fox Tempest attributions are Microsoft's and are unconfirmed for this platform; no MITRE profile is available for either in our reference data. We will monitor for additional reporting on the museads.ai infrastructure and the shared Next.js and Socket.IO stack, and will update this advisory if a second source confirms the endpoint or names additional domains. Clients running paid media through external agencies should treat the P1 identity hunt as the priority action today. --- [Read the original source โ†’](https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html?ref=f4n6.co.uk) *Published via PulseTrace โ€” Adverse Trace threat intelligence.*