Researchers found a real phishing operation that pretends to offer AI marketing tools (e.g., “Muse Ads”) and prompts users to click “Connect” to log in. The login pop-up looks like Google or Okta, but it’s a fake browser window embedded inside the webpage, designed to steal passwords and MFA codes, sometimes with a live human operator controlling the prompts.
This campaign impersonated AI advertising and marketing tools tied to well-known brand names, including tools resembling ChatGPT, Gemini, Claude, Perplexity, Manus, and Meta's Muse. Every fake product was built around a single consistent lure: a button labeled Connect that promised ad planning or audit features in exchange for linking a Google or Okta account. Clicking Connect launched a fake login experience rather than a real integration, designed specifically to capture credentials and MFA information from marketing, advertising operations, media buyer, and agency account manager roles.
The core deception relied on Browser-in-the-Browser, a technique that renders a convincing fake browser window directly inside the real webpage. This fake window could display trusted-looking addresses such as accounts.google.com or an Okta tenant, even though the actual browser address bar remained on the attacker's domain the entire time. Because the imitation closely mirrored real Google or Okta sign-in flows, victims had little visual reason to suspect anything was wrong.
What made this platform especially dangerous was its support for live, interactive MFA theft. It could retain multiple password attempts, request SMS or authenticator codes, trigger Google approval prompts, display QR codes, and send Okta push requests. In some cases a human operator actively controlled which MFA challenge the victim saw, and could reject submitted codes and ask victims to try again, maximizing the chance of capturing a usable code or approved push before it expired.
Targets included ad agencies, media buyers, and admin roles because a single compromised ad manager account can expose multiple client environments along with spending authority. This makes identity administrators managing Okta or Google Workspace, agency account managers, and executive assistants who approve ad spend especially high-value targets for this type of credential theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a technique that places a convincing fake browser window inside the real browser's webpage content, making a phishing login page look like a genuine Google or Okta sign-in popup while the actual browser stays on the attacker's domain.
Check the browser's actual address bar rather than any address shown inside the page, and try to move or resize the login window, since a fake window rendered inside a webpage cannot behave like a genuine browser window.
One stolen ad manager account can expose multiple client environments and spending authority, making roles like media buyers, agency account managers, and ad operations high-value targets.
Yes, a one-time code can still be stolen if entered into an attacker-controlled page while a human operator is waiting to use it, and operators can reject codes and ask victims to retry to capture a usable one.
You see a shiny new “Muse Ads” AI tool: ChatGPT, Meta, Google logos everywhere, and one big button: Connect. You click Connect and a Google or Okta login pops up. Looks legit, right? This is Browser‑in‑the‑Browser, a fake window inside the page built to grab your password and MFA codes. Behind the scenes, a live operator can keep rejecting your SMS, authenticator, or Okta push, "try again", until they get a usable code and walk straight into every ad account you manage. Here’s your move: if any AI ads tool asks you to Connect Google, Okta, Meta, or TikTok, stop and read the real browser address bar, if the domain’s off, close it and report it.
Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…
Criminal groups are stealing Meta Business Manager and Google Ads accounts using phishing that arrives through trusted platforms like Salesforce, Google Workspace mail-merge, and SharePoint links. The stolen accounts are valuable not just for the budget inside them, but because older accounts with…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
