Researchers at the browser security firm Island have uncovered a phishing campaign that uses counterfeit AI product websites to harvest credentials for online advertising accounts and their two‑factor authentication (2FA) codes. The findings were reported by Bleeping Computer.
The attackers deployed deceptive sites impersonating well‑known AI brands, including ChatGPT, Google Gemini, Claude and Perplexity. These fake pages promoted services such as audience targeting, campaign auditing and spend verification as a lure for victims.
According to Island, the campaign specifically targeted employees of advertising agencies, media buyers and administrators whose accounts provide access to multiple client ad accounts. To use the purported AI services, victims were prompted to link their ad accounts to the fake tools; that flow redirected users to a fraudulent Google sign‑in page, allowing the attackers to capture submitted credentials and 2FA codes.
The researchers also found that the attackers abused Meta’s Muse AI assistant as part of the deception. Analysis of the malicious infrastructure suggests the operation is likely part of a larger campaign that employs multiple lures to ensnare victims.
Stolen ad accounts can be abused to spend available ad budgets on fraudulent campaigns or sold to other cybercriminals for profit.
Island’s researchers advise caution: avoid clicking attractive ads that promise easy gains or convenience—especially if you manage high‑value campaigns or accounts with multiple client accesses. Verify sign‑in URLs and the authenticity of authorization prompts before linking accounts to third‑party AI tools.
