Island, a browser security firm, said it found a phishing platform posing as AI advertising tools. The fake products borrowed the names of Gemini, Claude, ChatGPT, Perplexity and Manus. Island said a fake Muse Ads product was online by September 16, eight days after Meta introduced Muse. BleepingComputer reported on the research on October 6.
Each page urged visitors to click Connect. That opens a fake Google sign-in window, a trick called browser-in-the-browser. It is a browser drawn inside the page, so the real address stays on the attacker's domain. BleepingComputer said a fake window cannot be moved outside the page, as a real pop-up can. Island said a human operator watches each entry and picks the next MFA prompt. Island saw hundreds of victim submissions. BleepingComputer said that does not necessarily mean that many accounts were taken. The sources do not say how many were.
Island says these pages are built to order and follow the news, so a new product launch is when a fake looks most convincing. When a person picks each MFA step, a one-time code becomes something the operator collects. Island says passkeys and hardware-backed sign-in remove that material. For a manager account, Island notes, the damage reaches the agency's clients, so those account holders have the most to gain from that kind of sign-in.