Fake AI Ad Portals: A Human-Operated Phishing Platform That Walks Ad Managers Through a Fake Login Window
Fake Gemini, Claude, ChatGPT and Muse ad portals use a browser-in-the-browser login window and a live operator to steal ad account passwords and MFA codes, Island found.
AegisAI Threat IntelligenceAegisAI Threat Watch · Browser-in-the-browser phishing
Fake AI Ad Portals: A Human-Operated Phishing Platform That Walks Ad Managers Through a Fake Login Window
A human-operated platform imitates AI advertising tools, draws a sign-in window inside the page and lets an operator steer each MFA step to take over ad manager accounts.
Analysis based on 6 October 2026 research by Island (Oleg Zaytsev and Ofek Ronen), with reporting by The Hacker News, BleepingComputer and The Register for the details the research post does not carry.
Fake AI ad portals use a browser-in-the-browser login window and a live human operator to steal ad account passwords and MFA codes from agency staff and media buyers.
The platform dresses itself as advertising tools from Gemini, Claude, ChatGPT, Perplexity, Manus and Meta Muse. A "Connect" button opens a sign-in window that is drawn inside the page, and an operator chooses which MFA screen the victim sees next. The prize is control of an ad manager account, not a single password.
Sources: Island (brands, the eight days, the three password slots) and The Register (the figure of about 200 addresses, which it attributes to Island).
Key judgments
- The product is the lure. Each fake tool promises something an advertiser would want, such as a Monday Google Ads brief or spend audits, and asks for one action: "Connect". The request reads as a normal integration step.
- The sign-in window is page content, not a browser window. The address bar the victim reads is text the attacker chose to draw, while the real browser stays on the phishing domain. The platform also rebuilds the provider screens itself instead of proxying the real ones, so there is no genuine sign-in page behind the overlay.
- A person answers each step, which is AegisAI's reading of the control model Island describes. The operator sees every submission and picks the next screen, so a defence tuned to a fixed script of password then code then done meets a flow that changes with the victim.
- The platform is reused, not rebuilt. A Muse Ads product appeared eight days after Meta launched Muse, and the same Next.js and Socket.IO stack serves ad, refund and recruitment lures. Individual lure domains are short-lived; the backend is not.
- The target is access with a payment method attached. A manager account reaches client accounts and stored cards, and Island reports that recovery can take weeks or months while the hijacked account keeps serving ads.
Who do fake AI ad portals target, and what do they offer?
The fake portals target agency staff, media buyers and manager-account administrators, and each one sells a believable advertising job. Island describes a human-operated phishing platform presented as a portfolio of AI advertising products, built around the work of managing ad spend.
Lures matched to the job
Island found the products tailored to what an advertiser would want. A fake ChatGPT tool promises a Monday Google Ads brief, a fake Gemini tool offers manager account (MCC) and linked-client support, and a fake Perplexity tool offers campaign planning and spend audits. The Hacker News lists six brands in all: Gemini, Claude, ChatGPT, Perplexity, Manus and Meta Muse.
Reskinned in eight days
Meta introduced Muse on 8 September 2026. Island reports that by 16 September museads[.]ai was presenting Muse Ads, and states that the operators added the fake product eight days after the launch. The Register adds that the page's code, including the sign-in forms and the fake browser window, came from the wider operation that had already run ad products for the other brands.
The brand changes in days; the login window, the operator and the backend stay the same. Defences keyed to a lure domain or a brand are always a few days behind.
AegisAI Threat IntelligenceHow does browser-in-the-browser phishing steal an ad account login?
It draws a fake sign-in window inside the page the victim already loaded, so the credentials go to the attacker while the address bar shows a trusted site. The technique was originally detailed by the researcher mr.d0x, in March 2022 according to BleepingComputer.
- The victim reaches a fake AI ad product page and clicks "Connect".
- The page opens an overlay that looks like a Google sign-in window, with an address bar showing accounts.google.com, or an Okta tenant (The Hacker News, BleepingComputer).
- The victim enters a password into the overlay. The platform supports Google, Meta, TikTok and Okta workflows.
- Page code sends client details to the backend; The Hacker News names
/api/send/ipas the call, and the operator sees the submission. - The operator pushes the next screen and the attacker signs in to the real account while the victim is still waiting.
What the victim sees
The overlay adapts to the visitor. Island reports that the fake browser renders for Windows, macOS, iOS and Android, and The Register adds that it mimics Safari's URL pill, Chrome's custom tabs and a dark mode.
What the browser knows
The real address never changes. Island's advice is to inspect the outermost origin, because the overlay cannot change it. BleepingComputer adds a practical difference: a genuine sign-in pop-up is a separate browser window, while an iframe-based overlay cannot be moved outside the page or resized.
Not a reverse proxy
Island contrasts the platform with a transparent reverse-proxy kit. This platform rebuilds the provider interface locally and collects credentials and MFA state through its own APIs. A control that looks for a proxy relaying a real sign-in page will find none.
What is account takeover in email security, and how does a human operator carry it out here?
Account takeover is an attacker gaining control of a real account and acting as its owner. Here the operator completes it by hand: the platform keeps the victim moving through password and MFA while the attacker uses each answer on the real service.
The control channel
Island found two Socket.IO events, operator-command and telegram-command, that feed a shared command vocabulary. The Hacker News reports that both events feed the same parser. The state object holds three separate password slots, which Island reads as deliberate retry handling, and BleepingComputer reports that the operator can ask for a password up to three times.
| Command (as named by Island) | What the operator can show |
|---|---|
/googlePrompt | A Google approval prompt |
/googleQrVerify | A supplied QR payload |
/verifyTap | A supplied tap number |
/oktaApprove | An Okta push request |
/oktaAuthApp | An Okta authenticator code request |
The same vocabulary includes /password, /2fa, /authApp, /wrong2fa, /done and /ban. The Hacker News and BleepingComputer describe the operator actions it covers as asking for another password, showing an SMS or authenticator challenge, rejecting a submitted code, and ending the flow.
Why it defeats ordinary MFA
The victim completes the real challenge for the real account at the moment the attacker needs it. A code, a push approval and a typed number are all things the victim can be talked into handing over inside a page the attacker controls. This is an inference from the reported mechanism, not a finding stated by Island.
Is the fake AI ad portal part of a larger phishing operation?
Yes. The AI ad pages are one family on a platform that also runs refund and recruitment lures from the same code. Island reports a shared Next.js and Socket.IO stack, with many branches using Vercel-hosted pages and Railway or Render services behind them for state and commands.
The other lure families
The Register reports separate builds for Adidas, Google Careers, Robert Half, Tesla and Louis Vuitton on the recruitment side, alongside refund and payment-confirmation pages. The operators exposed source code for earlier versions of the platform through misconfigured public GitHub repositories, which let researchers connect the families. BleepingComputer reports that this allowed the activity to be traced as far back as March.
Scale, with the limits stated
Island saw hundreds of victim submissions to the platform, and activity was still ongoing when the post was written. The Register reports that one frontend alone received submissions involving about 200 distinct email addresses over roughly a month, and that Island believes campaign-wide volume is substantially higher. A submission is not a confirmed compromise; BleepingComputer notes that the count does not necessarily equal compromised accounts.
Why standard controls miss it
The attack gives each common control a reason to see nothing wrong. This section is AegisAI's analysis of the reported mechanism, not a finding from the sources.
- The sign-in overlay is part of the page, so a check on the visible address bar passes. The real address belongs to a newly registered lookalike domain on ordinary hosting.
- The infrastructure is ordinary web hosting, which carries a good reputation by default. A reputation filter has little to hold on to.
- The MFA step is genuine. The victim approves or types a real challenge, so MFA is satisfied and the attacker still holds the session.
- The operator adapts. A rule that expects a fixed order of screens does not match a flow a person steers.
How AegisAI protects against it
Island does not describe how the pages reach victims, and the reporting links the platform to invitation emails, so the first control point is the message. The approach below applies to the invitation, before any overlay is drawn.
Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.
When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.
More on how that works: inbound email security.
What the reporting does not tell us
Delivery. Island does not describe its own email observations. Reporting says victims are reportedly lured by fake invitation emails, and Island notes that invitation emails sending victims to these pages have been documented elsewhere. No sender domains, subject lines or volumes are published here, so the inbox-side signature of this campaign is not yet public.
Scale. The figures are submissions, not confirmed compromised accounts, and no financial loss figure has been published.
The operators. The Register reports that Island has not identified the people operating the kit or the name under which it is sold.
Start date. BleepingComputer says the activity can be traced to March through exposed source code. Island's post does not give a start date, so the March figure rests on one outlet.
Longevity. The Muse Ads reskin shows how quickly a lure domain can change. Treat any single domain as short-lived; the platform vocabulary and backend patterns are likelier to persist.
Indicators of compromise
| Indicator (defanged) | Type | Reported use |
|---|---|---|
museads[.]ai | Domain | Fake Muse Ads product page, live by 16 September 2026 (Island) |
claude-ads[.]ai, gemini-ads[.]ai, openai-ads[.]ai | Domains | Fake AI ad product pages in Island's ads list |
link-mcc[.]com, mcc-invitation[.]com | Domains | Manager account (MCC) themed pages in Island's ads list |
refund-advertisers[.]com | Domain | Refund-themed page in Island's refund list |
tesla-careerapplication[.]com | Domain | Recruitment-themed page in Island's recruit list |
museadsback-production[.]up[.]railway[.]app | Backend host | Backend for the Muse Ads page (Island) |
backend-production-6d75[.]up[.]railway[.]app | Backend host | Appears in the ads, refund and recruit lists (Island) |
/api/send/ip, /api/create/user | Endpoints | Backend calls named by Island |
operator-command, telegram-command | Socket.IO events | Feed the shared command parser |
google_uid, api.ipify.org, ipapi.co | Client patterns | Island suggests correlating these across sites |
Island publishes the full list of domains and backend hosts. Match the full backend host names; the parent hosting domains are shared platforms and are used by legitimate sites. Treat the list as historical, not as a live blocklist.
MITRE ATT&CK mapping
This mapping is AegisAI's own reading of the reported behaviour.
| ID | Name | Use in this campaign |
|---|---|---|
T1566.002 | Phishing: Spearphishing Link | Invitation emails reportedly send victims to the fake AI ad product pages |
T1656 | Impersonation | Pages imitate advertising products from known AI brands, and recruitment and refund themes |
T1056.002 | Input Capture: GUI Input Capture | A fake sign-in window drawn inside the page captures the password and the MFA response |
T1111 | Multi-Factor Authentication Interception | The operator relays SMS, authenticator, push and QR challenges and retries rejected codes |
T1583.001 | Acquire Infrastructure: Domains | Lookalike domains registered for each brand and theme |
T1583.006 | Acquire Infrastructure: Web Services | Pages and backends run on commercial hosting such as Vercel, Railway and Render |
T1098 | Account Manipulation | After takeover, attackers add their own administrators and downgrade the legitimate owner (Island) |
Recommendations for defenders
- Require phishing-resistant, origin-bound authentication (FIDO2 security keys or passkeys) on every identity that can reach an advertising platform. Island recommends it, and a credential bound to the real origin is not released to a page on another origin.
- Treat any request to connect an ad account to a third-party AI tool as an access request. Route it through a named approver and verify the tool on the vendor's official site first.
- Review advertising control changes on a schedule: new managers, downgraded owners, changed recovery details and unapproved spend.
- Keep a baseline of trusted sign-in and advertising domains, alert on new lookalike domains that use AI-ad themes, and search web and proxy logs for Island's client patterns and the command vocabulary.
- Train agency and media teams to check the real browser address and to test whether a sign-in window can be dragged outside the page. A genuine pop-up is a separate window; the check supports the controls above and does not replace them.
FAQ
What is account takeover in email security and how does it work?
Account takeover is an attacker gaining control of a legitimate account and acting as its owner. In this campaign an invitation lure leads to a fake AI ad product, a fake sign-in window collects the password, and a live operator relays each MFA challenge so the attacker can sign in to the real ad account. The resulting access can run ad spend or reach client accounts.
What is browser-in-the-browser (BitB) phishing?
Browser-in-the-browser phishing draws a fake browser window, with a convincing address bar, inside a web page. The real browser stays on the attacker's domain, so what looks like accounts.google.com is only content. BleepingComputer reports that the window cannot be dragged outside the page or resized the way a genuine pop-up can.
How does a human operator get past multi-factor authentication?
The operator sees each submission over Socket.IO and chooses the next screen, such as another password prompt, an SMS or authenticator code request, a Google approval prompt, an Okta push or a QR code. The victim answers the real challenge while the attacker signs in, so MFA that relies on codes or approvals does not stop it. Island recommends origin-bound passkeys, because the credential is tied to the real site.
Who is targeted by fake AI ad portals and why does it matter?
Island says the targets are agency staff, media buyers and manager-account administrators. Those accounts can reach several client accounts with stored payment methods, and Island reports that recovering a hijacked account can take weeks or months while it keeps serving ads.
References
- Island (6 Oct 2026). Behind the Connect button: the fake AI ads campaign. island.io
- The Hacker News (6 Oct 2026). Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes. thehackernews.com
- BleepingComputer (6 Oct 2026). Fake ChatGPT, Gemini sites steal advertising accounts, MFA codes. bleepingcomputer.com
- The Register (7 Oct 2026). Browser-in-browser attacks use fake Meta Muse Ad lure to steal credentials. theregister.com
- MITRE ATT&CK. Techniques T1566.002, T1656, T1056.002, T1111, T1583.001, T1583.006 and T1098. attack.mitre.org
Every email, investigated.
Related posts
More from the AegisAI blog.