started · updated
AI services impersonated in sophisticated phishing campaign
Cybersecurity researchers have identified a sophisticated, human-operated phishing campaign that impersonates popular artificial intelligence services, including ChatGPT, Google Gemini, Claude, Perplexity, and Meta Muse. The attackers use fraudulent websites that claim to offer AI-driven advertising optimization, campaign management, or spend auditing tools to lure business users.
The campaign utilizes a technique known as ‘browser-in-the-browser’ (BitB). When victims click a ‘Connect’ button, a fake login window is drawn inside the legitimate browser. This window displays a convincing, spoofed address bar showing trusted domains like ‘accounts.google.com’ or Okta, while the actual browser remains on a malicious domain.
Unlike traditional automated phishing, this operation is managed by human actors in real-time. Operators can monitor login attempts, fingerprint the victim's device, and manually select which multi-factor authentication (MFA) challenge to present to the user, allowing them to bypass security measures and hijack business accounts, including access to payment methods and advertising data.
Entities
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] Security researchers at Island identified a phishing campaign using AI service names. financiarul.ro · www.go4it.ro
- [○ 1 SOURCE] An older version of the phishing platform was discovered in a misconfigured, public GitHub repository. www.go4it.ro
- [● 2 SOURCES] Attackers are using a 'browser-in-the-browser' (BitB) technique to display fake address bars. financiarul.ro · www.go4it.ro
- [● 2 SOURCES] The phishing campaign impersonates AI services including ChatGPT, Google Gemini, Claude, Manus, Perplexity, and Muse. financiarul.ro · www.go4it.ro
- [● 2 SOURCES] The campaign aims to steal Google account passwords and multi-factor authentication (MFA) codes. financiarul.ro · www.go4it.ro