Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

A phishing campaign targeting advertising account managers uses fake websites mimicking AI platforms like ChatGPT, Gemini, Claude, and Perplexity to steal login credentials and multi-factor authentication (MFA) codes. The attack employs browser-in-browser (BitB) techniques, where a fake Google login window is rendered inside an iframe, tricking users into submitting their credentials and MFA codes. The operation is part of a larger infrastructure using Next.js, Socket.IO, and Vercel frontends, with backend services on Railway or Render, and includes lures such as fake recruitment and refund pages. Human operators manage the phishing flow in real time, requesting credentials and MFA codes via Socket.IO events.

AI-extracted · verify before operational use