Fake AI Chatbot Ad Portals Harvest Credentials and MFA Codes
What Happened — Researchers uncovered a human‑operated phishing platform that mimics advertising pages for AI chatbots such as Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The fake portals claim to provide campaign‑optimization and business‑account integration services, but instead capture users’ login credentials and one‑time MFA codes.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of credential use and MFA token validation to detect abnormal authentication patterns.
- Highlights gaps in phishing‑resistant authentication and the importance of evidencing that access‑control policies are enforced and audited.
- Aligns with the control objective of Identity & Access Management—a single control that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001, SOC 2).
Who Is Affected – Enterprises that promote or integrate AI chatbot services, spanning SaaS providers, digital‑marketing firms, financial services, and any organization with privileged access to AI platforms.
Recommended Actions –
- Deploy phishing‑resistant MFA (e.g., hardware tokens, push‑based approvals) and enforce its use for all privileged accounts.
- Implement real‑time credential‑usage analytics to flag anomalous logins or MFA code submissions.
- Conduct targeted security‑awareness training focused on AI‑related phishing lures.
Technical Notes – The attack vector is a credential‑harvesting phishing site masquerading as an AI‑ad portal. No specific CVE is involved; the threat relies on social engineering and the capture of one‑time MFA codes entered by victims. Source: https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html