ChatGPT, Gemini, and Claude imitated in fake ads that steal credentials and MFA codes (www.techradar.com)

A recent cybersecurity report has revealed a phishing campaign targeting advertisers and marketing managers, impersonating well-known AI tools like ChatGPT, Google Gemini, and Claude to steal credentials for Google business accounts. This operation employs sophisticated tactics, including a browser-in-the-browser (BitB) approach that disguises malicious sites as legitimate, fooling victims into entering their login information. Researchers from Island found that the platform used custom scripts and human operators to manipulate user experiences, leading to more successful data theft. The significance of this development for the AI/ML community lies in the exploitation of branded technology to lure victims, showcasing a new threat landscape where trusted AI identities are co-opted for financial gain. It underlines the pressing need for enhanced cybersecurity measures among organizations, urging them to treat AI integrations cautiously and adopt phishing-resistant authentication methods. As these scams can lead to considerable financial losses, particularly given their focus on business accounts linked to payment methods, it emphasizes the necessity for vigilance and robust security protocols within the digital advertising ecosystem.