A phishing campaign is impersonating popular AI tools to steal login credentials and multi-factor authentication codes from people who manage online advertising accounts. Researchers say the attackers use browser-in-browser fake Google sign-in windows, support Google, Meta, TikTok, and Okta workflows, and rely on human operators who can prompt for SMS codes, authenticator codes, push approvals, or QR scans in real time. The infrastructure uses Next.js, Socket.IO, Vercel frontends, and Railway or Render backends, and exposed GitHub code links the operation back to at least March 2026.
Why it matters: This can lead directly to takeover of business ad accounts that control spending for multiple clients, causing fraud and downstream compromise. Agencies, media buyers, and admins should treat AI-themed account-connection prompts with suspicion, verify real pop-up windows before signing in, and review MFA and account activity now.
Bill Toulas
2026.10.06
100% relevant
This article establishes a distinct, named campaign focused on fake AI product sites and browser-in-browser credential theft aimed specifically at advertising account managers and their downstream client accounts.
← Back to all stories