According to the reporting, victims are lured to the spoofed sites and prompted to sign in, at which point the stolen credentials and MFA codes are captured. The attackers appear to be focused specifically on advertising accounts, which can be abused for malicious ad campaigns or resold.

Key points:

• The campaign impersonates ChatGPT, Gemini, Claude, and Perplexity.
• It targets advertising account managers.
• Browser-in-browser attacks are used to make fake login windows look genuine.
• Both login credentials and MFA codes are stolen.

There is no specific CVE or advisory identifier cited in the source for this campaign, so none is included here. Users managing ad accounts should treat unsolicited links to AI login pages with caution and verify they are on the legitimate domain before entering credentials or MFA codes.

Source: Publication Name

Has anyone in the community seen similar browser-in-browser lures targeting ad account teams, and what steps are you taking to verify login pages?