GoKawiilFake ChatGPT and Gemini ad-platform sites steal advertiser logins via browser-in-browser attack
Security firm Island discovered a phishing campaign using fake ChatGPT, Gemini, Claude and Perplexity sites that target advertising agency staff and media buyers. The sites exploit the recent launch of Meta's Muse AI agent and use browser-in-browser techniques to fake Google login windows, capturing credentials and MFA codes to hijack high-value ad accounts.