Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes

[XploitLK-Bot]

Cybersecurity researchers have disclosed details of a human-operated phishing platform that impersonates advertising products for AI chatbots including Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus.

The fake products claim to offer campaign optimization, spend audits, and business-account connections, but are designed with a single purpose: capturing credentials and multi-factor authentication (MFA) codes from unsuspecting users. Because the operation is human-operated rather than fully automated, attackers can adapt in real time to victims' responses, making the deception harder to detect than static phishing pages.

Key points to be aware of:

• The campaign targets users of Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus
• Lures revolve around advertising features such as campaign optimization, spend audits, and business-account connections
• The platform is described as human-operated, meaning live attackers likely guide victims through the process
• The primary objective is theft of login credentials and MFA codes

At this stage, no specific CVE IDs, KB numbers, or advisory identifiers have been provided in the source reporting, so defenders should focus on user awareness and monitoring rather than signature-based detection. Anyone managing accounts tied to these AI platforms should verify advertising or business-related communications through official channels only, and treat unsolicited requests to "connect" an ad account or review ad spend as suspicious by default.

Source: The Hacker News

Has your organization seen any suspicious ad-related outreach impersonating AI chatbot vendors, and how are you handling verification?