Fake ChatGPT and Gemini Ads Portals Steal Logins and MFA Codes

The email contains no threat and no deadline. Its subject line reads "Your Gemini Ads workspace is ready," the sender name is Gemini Ads, and it passes SPF, DKIM and DMARC. That is how IRONSCALES described a message that reached a paid media manager at a global advertising agency in late August.

On October 6, 2026, researchers at Island showed what sits behind the button in invitations like that one: a phishing platform run by live human operators and dressed as ad products from the best known names in AI. The window it shows says accounts.google.com. Your browser is somewhere else.

Key Takeaways

• Island's report "Behind the Connect Button," published October 6, 2026, describes a human operated phishing platform posing as advertising products for ChatGPT, Gemini, Claude, Perplexity, Manus and Meta's Muse.
• The Connect button on each portal draws a fake browser window whose address bar reads accounts.google.com while the real browser stays on the phishing domain.
• A live operator can keep three password attempts, request SMS or authenticator codes, show Google or Okta approval prompts and reject a code, across Google, Meta, TikTok and Okta sign ins.
• IRONSCALES and Intezer documented the invitation emails that lead to these pages, and the IRONSCALES sample passed SPF, DKIM and DMARC from a domain registered thirteen days earlier.
• CISA says FIDO/WebAuthn is the "only widely available phishing-resistant authentication," and Island recommends origin bound passkeys and hardware backed authentication against this platform.

What Did Island Find Behind the Connect Button?

Island found one phishing application wearing many brands: fake advertising products for ChatGPT, Gemini, Claude, Perplexity and Manus, joined in September by a fake Muse Ads. Researchers Oleg Zaytsev and Ofek Ronen say each brand gets its own pitch. The ChatGPT page offers a weekly Google Ads brief, the Gemini page offers manager account (MCC) support, and the Perplexity page offers spend audits. Island says the lures are written for agency staff, media buyers and manager account administrators.

The newest skin moved fast. Meta introduced Muse, the personal AI agent at the centre of a dispute over private messages, on September 8, 2026. By September 16, museads.ai was presenting "Your AI ads manager for paid media workflows." That is eight days.

The operation is older than Muse. Island's earliest retained sightings this year run from a Manus and Meta lure on March 11 through ChatGPT (March 31), Claude (April 29), Gemini (May 12) and Perplexity (June 30), and it cautions that these are not launch dates. The same routes and retry logic appear in older fake recruitment builds the operators left in public GitHub repositories. Island's post includes a spoofed Tesla recruitment page from July 2025.

Island says it saw hundreds of victim submissions and that activity was ongoing when it published. BleepingComputer notes that the figure does not necessarily equal compromised accounts, and describes "dozens of URLs." We counted Island's indicator list and it is longer than that: 109 lure hostnames and 28 backend hosts. Of the lure hostnames, 20 use Claude or Anthropic names, 17 use Gemini (two of them misspelled as gemimi and gennini) and 12 use ChatGPT or OpenAI. Headlines lead with ChatGPT. The domain list leans toward Claude.

How Do Victims Reach the Fake Portals?

Victims arrive by email, according to every source that addresses the question. Island writes that the invitation emails sending people to these pages were documented by IRONSCALES and Intezer. The Hacker News says users "are assessed to be directed" to the pages through fake invitation emails. None of the three reports describes paid ads, search results or direct messages as a way into this campaign.

The IRONSCALES sample, published September 9, 2026, shows how much work goes into the envelope. The attacker registered gemini-beta-invites.com thirteen days before the send, then added what a legitimate bulk mailer would have:

• An RFC 8058 one click unsubscribe header and an unsubscribe mailbox that really received mail.
• A corporate postal address in the footer, plus passing SPF, DKIM and DMARC results on mail sent through Amazon SES.
• The recipient's own address encoded inside the unsubscribe link, which IRONSCALES reads as a list built for named people.

Intezer, in a report dated August 25, 2026, describes a similar Gemini Ads invitation tied to gemini-advertisers.com. We checked both domains against Island's indicator list, and both are on it. That closes a gap. IRONSCALES wrote that what happens after the click "is not in the record." Island's report is that record.

How Does the Fake Google Window Work?

The page draws a second browser window inside itself, with a lock icon and an address bar that reads accounts.google.com, while the real browser never leaves the phishing domain. The technique is called browser in the browser (BitB), and we covered the basics in our guide to fake login popups.

This build is polished. Island says the fake window adapts to Windows, macOS, iOS and Android, and that newer versions copy Safari's URL pill, Chrome's custom tabs and dark mode. One comment left in the code explains why the toolbar gets a frosted blur: without it, the browser chrome "looks painted-on and gives away the fake."

Why Does a Live Operator Beat SMS and Authenticator Codes?

A typed code works for whoever enters it on the real site, and Island's diagram shows the attacker attempting the login in real time while the victim is still on the page. The fake window is only the display. Underneath, Island describes a remotely controlled state machine:

• Setup. Clicking Connect creates a record through /api/create/user. The page then fingerprints the device, from IP and location down to screen size and WebGL, and posts the profile to /api/send/ip.
• Passwords. The state object has three slots named password_one, password_two and password_three. An operator can reject an entry, ask again and keep every value typed.
• MFA on demand. Commands include /2fa for an SMS code, /authApp for an authenticator code, /googlePrompt for a Google approval prompt, /googleQrVerify for a QR code and /oktaApprove for an Okta push. /wrong2fa rejects the current code.
• Transport. Commands arrive over Socket.IO events named operator-command and telegram-command, and the older builds on GitHub use Telegram as the control channel.

NIST's digital identity guideline SP 800-63B says authenticators that rely on manual entry are not phishing resistant, because typing a code "does not bind the authenticator output to the specific session being authenticated." Number matching is no escape. CISA's fact sheet on phishing resistant MFA rates app codes and push with number matching as resistant to push bombing but still vulnerable to phishing, and this kit has a command for it: /verifyTap, which Island describes as showing a supplied tap number.

The design also differs from the proxy kits. A transparent reverse proxy such as VoidProxy, which we covered in September, relays the genuine login page. This platform, in Island's words, "locally rebuilds the provider interface" and collects credentials through its own APIs, so the traffic looks like an AI product talking to an unrelated application backend. Every brand runs on one Next.js and Socket.IO stack. A single Railway backend appeared in 73 archived scans across 25 page domains between May 27 and June 20, serving AI ad lures, refund pages and a fake Louis Vuitton careers site.

Why Email Users Should Care

A stolen Google login is a stolen Gmail inbox. Google Ads Help puts the dependency plainly: "anyone with access to your Google Account can access your Google Ads account." It runs the other way too. The password and code typed into a fake ads portal belong to the whole Google Account, mail included. Island makes the same point about the fake job pages: an applicant who signs in with a work Google or Okta identity can expose the current employer's email, files and SaaS apps.

Ad accounts are the prize because a thief can spend them or sell them. Mimecast's research on ad account theft, published July 28, 2026, counts 6.4 million detections over four years and says aged accounts with a clean spend history sell at a 2 to 4 times premium. One listing it documents prices Google Ads accounts for crypto and iGaming advertisers at about $270 retail and $200 in bulk. Set that $270 beside the damage Island describes: attackers add their own administrators, downgrade the owner, and recovery "can take weeks or months."

The inbox sits at both ends of this attack. It delivers the lure with clean authentication results, and it needs cleaning afterwards. Google's own recovery checklist tells Gmail users to remove any "labels, filters, or forwarding rules" they did not set up.

How Do You Spot and Stop a Fake Sign In Window?

Try to drag the sign in popup outside the browser window: a real popup leaves, and a drawn one cannot. Then add controls that do not depend on your eyes.

1. Drag it. BleepingComputer notes these fakes "cannot be moved outside the browser window or resized." Island's version: read the real address bar, because a page "cannot change the real browser origin." A phone has no window to drag, and this kit imitates mobile browser chrome, so on mobile never sign in from an emailed link.
2. Let your password manager vote. The UK's NCSC says "the password will only autofill on the correct website." If it offers nothing inside a window that claims to be Google, stop.
3. Use a passkey or hardware security key, then stop typing your password. A passkey is bound to the real site, so a drawn window cannot collect it. One catch: Google says adding a passkey does not "change or remove any authentication or recovery factors currently on your account." Your password and codes still work, and those are what the fake window asks for. Google's Advanced Protection Program closes that door, since members are "required to sign in with a passkey or security key."
4. Verify the product, not the email. Island advises confirming beta programs and ad connectors on the vendor's official site. IRONSCALES adds that an unsubscribe link, a postal footer and clean authentication should count as neutral. Weigh the domain's age instead.
5. If you already typed something, move now. Change the Google password, review signed in devices and check Gmail for unknown filters or forwarding. Then check every ad account that login can reach for new managers or partners, changed recovery details and spend nobody approved.

For security teams, Island recommends hunting for /api/send/ip, /api/create/user and Socket.IO connections to unrelated Railway or Render hosts, plus the event names operator-command and telegram-command.

Looking Ahead

Expect the next skin within days of the next launch. Island argues that a brand new product is exactly when a fake one looks most convincing, and Muse Ads took eight days. Island's indicator list already holds names that made no headline, including adsmistral.com, cursor-ads.com and semrush-ai.com.

None of the reports names who runs the platform or counts the accounts taken over. Until that changes, treat any Connect button that arrives by invitation as a request for your Google password.