Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes

Cybersecurity researchers have uncovered a human-operated phishing platform impersonating AI chatbot advertising portals such as ChatGPT, Google Gemini, and Anthropic Claude. The fake portals use the browser-in-the-browser (BitB) technique to spoof legitimate login pages and harvest credentials and multi-factor authentication (MFA) codes. The campaign targets agency staff and ad account administrators, aiming to steal and monetize advertising accounts. The infrastructure leverages Next.js and Socket.IO, shares common endpoints, and has exposed source code via misconfigured GitHub repositories.

AI-extracted · verify before operational use