Security vendor Island published a report describing a phishing campaign in which attackers impersonate ChatGPT, Gemini, Claude, Perplexity, Manus and other major AI brands, advertising fake “AI marketing tools” that prompt agency staff, media buyers and manager-account admins to connect their Google account. Clicking “connect” launches a browser-in-the-browser (BitB) phishing page with a live human operator who fakes mistyped-password errors and chooses which MFA screen the victim sees, harvesting credentials and one-time codes. The lures target advertising accounts specifically because they carry stored payment methods, approved budgets and, for manager accounts, access to multiple client accounts; the campaign was still running and had not been disrupted when the researchers wrote the report.

OpenAI·ChatGPT·Google·+5