Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes

Researchers disclosed a coordinated phishing platform that impersonates AI chatbot ad-management products (e.g., ChatGPT, Gemini, Claude, Muse) to steal credentials and MFA codes via browser-in-the-browser (BitB) windows, fingerprint victims, and exfiltrate data over Socket.IO; the operation targets agency staff and ad account managers to monetize or sell high-reputation ad accounts, leverages shared Next.js/Socket.IO infrastructure (e.g., museads.ai), and overlaps with refund/payment and recruitment lures and observed malware delivery (NetSupport RAT).