If you manage ad accounts, you’re walking around with keys to real money. Attackers know it. A newly observed phishing campaign uses fake “ChatGPT / Gemini / Claude / Perplexity” (plus a Meta Muse-themed lure) to bait ad teams into clicking a friendly “Connect” button—then hits them with a convincing sign-in pop-up that isn’t a real browser window at all. It’s a browser-in-browser (BitB) fake designed to steal passwords and push you into approving MFA. And yes, there can be a live operator on the other end telling you to “try again” until they get what they need.
Who they’re targeting (and why ad teams are perfect victims)
If you’re in an agency or growth team, your login isn’t “just a login.” It’s often a master key.
Researchers tracking this fake “ChatGPT / Gemini / Claude / Perplexity” phishing campaign found it was aimed right at agency staff, media buyers, and ad account administrators—the people who sit at the center of multiple clients, multiple platforms, and lots of spend . That target profile isn’t random. It’s math.
The exact victim profile attackers want
Attackers do best when one compromise fans out into many accounts. Ad operations is built like that.
Typical high-value targets include:
- Agency staff who manage multiple brands from one identity (or one SSO)
- Media buyers with day-to-day access to budgets, campaigns, pixels, and audience tools
- Admins whose permissions “roll up” into multiple downstream client accounts
If you’ve ever had access to “Business Manager,” “Ads Manager,” partner accounts, or shared workspaces, you already know the problem: one trusted user can be connected to a lot of money.
Why stolen ad access is so profitable
Once someone has valid credentials and can get you to approve MFA, they don’t need to break in again. They just act like you.
In this campaign, the payoff is straightforward:
- Fraudulent ad spend: Attackers can burn through available balances by running junk campaigns as if they’re your team
- Resold access: Compromised ad accounts can be sold to other criminals for significant amounts, because “clean” ad access is an asset that keeps working
Why the “AI tool” angle hits ad teams harder
The lures are positioned as ad-boosting helpers—promising to help advertisers reach buyers, get ad briefs, and plan/audit campaigns and spend . If you’re judged on performance, speed, and output, that pitch lands on a busy day.
And that’s the real trap: it doesn’t look like a sketchy “security alert.” It looks like work.
How the scam works: the “Connect” button, BitB pop-ups, and a human operator
The trick isn’t “hack the platform.” It’s “make the login feel routine.”
These phishing pages pose as helpful AI tools for advertisers, then gate the “good stuff” behind a familiar action: Connect your account. That single click is the handoff from marketing bait to credential theft .
The step-by-step flow (what you’ll actually see)
Here’s the pattern Island’s researchers documented:
- You land on a fake AI product page that promises ad help (briefs, planning, auditing spend).
- You click Connect.
- A “Google sign-in” (or Meta / TikTok / Okta style sign-in) pops up and looks legit.
- The header even shows a believable URL like accounts.google.com.
- You enter your credentials, then you’re pushed to complete MFA. Your password and MFA “state” get captured.
That “popup” is the key move: it’s a browser-in-browser (BitB) fake. In plain language, it’s a login window drawn inside the page—a convincing iframe that copies the look of a real OAuth sign-in prompt.
Why this doesn’t feel like classic phishing
Old-school phishing is a form and a fake domain. This feels like normal OAuth.
The BitB window is designed to mimic:
- Real browser chrome (tabs, address bar look, window styling)
- The login UI you expect
- The “I’m just connecting an app” workflow
And the campaign doesn’t stop at the form.
The human operator: the “support rep” that keeps you typing
Once you’re in the BitB flow, a live operator can take over and control what you see next.
That’s how they turn MFA into a grind you eventually lose. The operator can:
- Ask for your password again (up to three times)
- Request an SMS code or authenticator app code
- Trigger Okta push requests or Google approval prompts
- Show a QR code to “complete sign-in”
- Reject your code and tell you to “try again,” keeping you stuck in a loop until they get a fresh, valid MFA response
That last part is what throws people off. When the page “fails” after you enter a code, it doesn’t always raise alarms—because everyone’s seen MFA be flaky. Attackers use that muscle memory against you.
What’s under the hood (so you respect how organized this is)
If the last section made this feel “personal,” the infrastructure should make it feel industrial.
Researchers tied the fake AI “Connect” pages to a broader operation with repeatable parts: same build pattern, same plumbing, lots of lures, fast rotation. This isn’t one scam page. It’s a kit.
The stack: built to copy-paste at scale
Across the different lure pages, investigators saw the same technical fingerprint:
- A shared Next.js + Socket.IO stack across pages tied to the operation
- Common API endpoints reused across the sites
- Vercel used for frontends, paired with Railway or Render for backends
That combo matters because it’s fast to deploy and easy to duplicate. Spin up a new “ChatGPT for ads” clone today, a “Gemini audit tool” tomorrow, and a “refund portal” on Friday—without rebuilding everything from scratch. Researchers did see multiple lures tied to the same operation, including recruitment and refund themes .
Command-and-control: real-time control, sent like chat messages
Socket.IO isn’t just “a library choice” here. It enables real-time back-and-forth.
Island’s researchers noted that:
- The phishing platform’s commands are sent through Socket.IO events
- Victim activity and “submissions” were routed into a Telegram control channel
- That Telegram channel had hundreds of victim submissions (not the same as confirmed takeovers, but it shows volume)
Translated: while you think you’re “connecting an app,” they’re running a live workflow behind the scenes, watching what you type and deciding what prompt you see next.
The breadcrumb that exposed how long it ran
One of the reasons researchers could link pages together is almost funny in a dark way: the attackers exposed older source code via misconfigured public GitHub repositories, which helped trace activity back as far as March .
That’s the part to internalize: this wasn’t a weekend project. It ran long enough to iterate, expand lures, and rack up victims—then keep going.
Spot it fast, stop it faster: a tactical checklist for ad managers
You don’t need to reverse-engineer a phishing kit to beat it. You just need a few “hard stop” checks your team follows every time, even when you’re rushing.
Quick detection: the BitB pop-up gives itself away
The cleanest tell is physical, not technical.
Do this the moment a login pop-up appears:
- Try to drag the pop-up outside your browser window.
A real OAuth window is its own browser window. A browser-in-browser (BitB) fake is an iframe, so it can’t be moved outside the main browser or resized like a real pop-up.
- Try to resize it like a normal window.
Same deal: real windows behave like windows. BitB doesn’t.
- Slow down at the URL moment.
If you’re “connecting” a tool and it suddenly asks you to sign in, treat that as a risk event. Don’t trust a URL-looking header inside the pop-up.
Habits that prevent the “I was busy” mistake
Keep these rules simple enough that people will actually use them:
- No logins from links in ads, DMs, or random “AI tool” pages. If you need to sign in, open a new tab and go to the platform directly.
- If MFA fails once, stop. Don’t keep retrying because “auth apps glitch sometimes.” In these attacks, repeated prompts can be part of the playbook.
Containment: limit the blast radius even if someone slips
BitB phishing is built for scale. Your defenses should be, too.
Lock down who can connect apps:
- Limit which users can approve new “Connect” / OAuth-style integrations wherever your stack allows it.
Review what’s already connected:
- Make “connected apps” reviews a standing calendar item, not a one-off cleanup.
Watch the signals attackers can’t hide:
- Spend spikes that don’t match planned pacing
- New admins / new partner accounts
- Odd login locations or logins at weird hours
Upgrade MFA where possible:
- Move to phishing-resistant MFA options in your identity stack when you can (the goal is making “approve this prompt” less useful to attackers).
One practical habit that cuts your risk: stop giving out your real contact points
Most “account support” scams don’t start at the login screen. They start earlier—when someone gets a clean path to reach you while you’re busy.
Island’s research connected this operation to a broader set of lures beyond fake AI ad helpers, including recruitment and refund themes . Different story, same delivery channels: email, SMS, and DMs that are easy to ignore… until one lands at the wrong time.
The habit: separate your admin identity from your public identity
If your ad-platform admin login uses the same email/phone you hand out for:
- vendor demos
- newsletters and “early access” waitlists
- influencer/partner outreach
- job boards and recruiting threads
…you’re giving attackers a straight line to your highest-privilege accounts.
A better pattern is compartmentalization:
- Use one set of contact points for ad platform logins (Google, Meta, TikTok, Okta-linked access)
- Use different contact points for vendor sign-ups and anything that’s exposed publicly
When a phish hits the “public” inbox, it doesn’t automatically reach the identity that can approve a “Connect” flow.
How to do it without creating a mess
Keep it practical. Two lanes is enough:
- Admin lane: only for ad platforms + identity provider accounts
- Intake lane: for vendors, tools, communities, and random inbound
If you want an easy way to do this, Cloaked can help by generating separate emails and phone numbers for sign-ups, so you can keep vendor intake away from your ad admin identity. This isn’t about hiding. It’s about making sure a lure aimed at your most reachable contact info doesn’t automatically land on the keys to spend.
The payoff
Attackers scale by blasting lures across themes and channels . You cut their odds by shrinking what they can reliably reach—especially when they’re counting on you being in a hurry.
