Threats I hunted
Behind the Connect Button
A sophisticated Browser-in-the-Browser phishing operation using spoofed Meta AI ads and live human operators to bypass MFA in real time.
- 8 days
- from domain registration to live attack
- Real-time MFA
- live operator push bypass
- Meta Muse
- spoofed AI video generator ads
Attackers launched targeted ads on Meta promoting a non-existent "Meta Muse" AI video generator. The ads directed enterprise users to high-fidelity fake landing pages with embedded Browser-in-the-Browser (BitB) popups.
Behind the scenes, a live operator console intercepted login credentials and one-time MFA codes in real time, bypassing MFA protections before users noticed. Island neutralized the infrastructure and published the full investigation.
In the press
The RegisterBrowser-in-browser attacks use fake Meta Muse Ad lure to steal credentials TechRadarChatGPT, Gemini, and Claude imitated in fake ads that steal credentials and MFA codes BleepingComputerFake ChatGPT, Gemini Sites steal advertising accounts, MFA codes The Hacker NewsFake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes Cyber InsiderFake ChatGPT and Gemini ad tools bait users with bogus login windows Consumer AffairsFake ChatGPT scam uses trusted websites to trick users into installing malware eSecurityPlanetFake AI Marketing Sites Put a Browser Inside Your Browser to Steal Logins Windows ReportResearchers Warn Fake ChatGPT and Gemini Sites Are Stealing MFA Codes
- Cyber Security NewsHackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes
- Cyber PressHackers Impersonate ChatGPT, Claude and Gemini in Human-Operated MFA Phishing Campaign
- GBHackersFake ChatGPT, Claude and Gemini Ads Use Browser-in-the-Browser Phishing to Steal Accounts
- NeoTeoIsland reports fake AI-ad portals steering sign-ins in real time
- TechNaduFake ChatGPT, Gemini, and Claude Ad Tools Steal Logins and MFA Codes in New Phishing Campaign
Read the research
BadBlocker