Fake AI Sites Used in Credential Theft Campaign
A new phishing campaign discovered by researchers targets advertising account managers by impersonating popular AI services such as ChatGPT, Gemini, Claude, and Perplexity. The fake websites claim to offer tools for reaching buyers, obtaining ad briefs, and planning and auditing advertising campaigns. To access these features, users are prompted to connect their advertising accounts to the supposed AI assistant.
However, clicking the 'Connect' button triggers a browser-in-the-browser (BitB) attack, where a counterfeit login window appears inside the legitimate page. This fake window mimics the Google sign-in interface, displaying a realistic URL like accounts.google.com in the address bar, but is actually an iframe designed to harvest credentials and multi-factor authentication (MFA) codes.
How Browser-in-the-Browser Attacks Work
The BitB technique, first demonstrated by security researcher mr. dox in March 2022, creates a simulated browser window within a real browser to display a fraudulent login prompt. While the fake interface looks authentic — complete with expected titles, styling, and URL — it operates inside an iframe and cannot be resized or moved outside the browser window, unlike legitimate OAuth popups.
Researchers from browser security firm Island noted that the phishing kit used in this campaign adapts to various operating systems and browsers, including Windows, macOS, iOS, and Android, with support for both light and dark modes. Once the victim interacts with the fake window, a human attacker takes over the session in real time, controlling the flow of prompts.
The attacker may request the password up to three times, ask for SMS or authenticator codes to bypass MFA, display Okta push notifications, show Google approval prompts, or present a QR code. They can also reject valid codes, hold victims on a waiting screen, or terminate the phishing flow at any point.
Campaign Linked to Larger Infrastructure
Analysis of the attack infrastructure revealed that this campaign is part of a broader operation that also employed lures such as fake job recruitment pages and refund offers. All associated pages share a common technology stack: Next.js frontend, Socket.IO for real-time communication, and hosting on Vercel with backends on Railway or Render.
The connection to the larger operation was confirmed after researchers discovered exposed source code in misconfigured public GitHub repositories, allowing them to trace activity back to March. Additionally, the Telegram channel used for command and control had received hundreds of victim submissions, though this number may not reflect the total count of successfully compromised accounts.
Detection and Defense Insights
Despite their deceptive appearance, BitB attacks have a detectable weakness: the inability to move or resize the fake window. Legitimate browser windows allow such actions, but iframes used in BitB cannot be manipulated this way. This behavioral difference can help users and security tools identify spoofed login prompts.
Island researchers confirmed that the platform supports credential harvesting for Google, Meta, TikTok, and Okta sign-in flows, with data exfiltration handled through Socket.IO events. Unlike reverse-proxy-based tools, this kit locally reconstructs the login interfaces and collects credentials via its own APIs, helping to mask malicious traffic as legitimate AI-to-backend communication.
The operation relied on dozens of distinct URLs targeting advertising, refunds, and recruitment themes. The full list of associated domains has been published in the researchers’ report.
Source: BleepingComputer