Fake AI Ad Portals Harvest Credentials & MFA Codes

Cybersecurity researchers disclosed a “human-operated phishing platform” that impersonates advertising products for artificial intelligence chatbots such as Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus.¹ The attackers present themselves as legitimate campaign‑optimization tools, claiming to offer spend audits and business‑account connections.¹ When users click the links, they are redirected to counterfeit login pages that record every credential entered, including multi‑factor authentication (MFA) codes sent via SMS or authenticator apps.¹

This attack leverages the current trust in AI platforms; users are highly motivated to access these tools for business purposes. It is an evolution of traditional credential harvesting, now capturing both passwords and MFA tokens.¹

The human‑operated nature of the platform means attackers actively monitor responses, adjusting tactics in real time. Similar techniques have been observed with credential harvesting via fake banking login pages, where attackers use sophisticated social engineering to convince victims that their credentials are safe.

Experts note that this approach goes beyond simple password theft: it also captures MFA codes, which many organizations consider a strong defense against phishing. The “optimization” portals likely employ legitimate advertising APIs to appear authentic before subtly redirecting users through fake login pages that record everything entered. A similar tactic was seen in 2018 with fraudulent LinkedIn ads targeting financial professionals, as reported by Verizon DBIR.

This new vector poses significant risks for businesses that rely on AI chatbots for customer engagement or internal workflows. If employees log into these counterfeit portals using corporate credentials, entire organizational accounts could be compromised. Moreover, because the attack uses standard ad platforms and does not trigger typical security alerts, detection is difficult until after compromise. Organizations should verify any third‑party tool claiming integration with AI services and enforce strict access controls, such as limiting permissions to only those who need them. Multi-factor authentication remains essential; however, it must include app-based tokens rather than SMS where possible, as SMS can still be intercepted.

The discovery underscores how rapidly evolving technology creates new avenues for credential harvesting. Attackers are exploiting trust in AI tools—an area that continues to expand—and combining social engineering with technical bypasses of MFA. As more businesses adopt complex security measures like passkeys, this type of phishing may spread beyond AI ad platforms. Vigilance, verification, and robust MFA implementation will remain critical defenses against this emerging threat.