Island researchers have documented a phishing platform that poses as advertising products from ChatGPT, Gemini, Claude and other AI brands. A "Connect" button opens a fake browser window with a believable address bar, and a live operator then walks the victim through password and MFA prompts for Google, Okta and other accounts. Because codes and push approvals are relayed live, Island points to origin-bound passkeys as the defense.
What happened
Island researchers Oleg Zaytsev and Ofek Ronen published the analysis on October 6, 2026. The lure sites pitch fictional AI ad integrations to advertising professionals. The Hacker News summarized the targets as agency staff, media buyers and manager-account administrators. Island says each brand gets a tailored pitch: the ChatGPT page offers a Monday Google Ads brief, and the Gemini page offers MCC (manager account) and linked-client support. Brands impersonated include ChatGPT, Gemini, Claude, Perplexity, Manus, Mistral and Semrush. The operators also react quickly to news. Meta announced its Muse AI agent on September 8, 2026, and by September 16 museads.ai was advertising "Muse Ads."
When the victim clicks Connect, the page draws a fake Chrome or Safari window inside itself, with an address bar showing a legitimate sign-in host such as accounts.google.com. This is the browser-in-the-browser (BitB) technique. The real browser URL stays on the phishing domain. Island says the platform supports Google, Meta, TikTok and Okta sign-in flows.
Behind the page sits a Next.js and Socket.IO stack. Island describes a human operator who watches submissions and sends commands such as /2fa (SMS code), /authApp (authenticator code), /googlePrompt and /oktaApprove to choose the next screen. The backend accepts up to three password attempts, so the operator can reject a password and make the victim enter it again. One Railway-hosted backend appeared in 73 archived scans across 25 page domains between May 27 and June 20, tying AI-ad, refund-scam and fake-recruitment pages to the same operation. The researchers listed more than 100 phishing domains in their IOC section, with Railway and Render backend hosts. According to Island, stolen ad accounts sell on Telegram for $200 to $270.
Why it matters
Ad accounts are an identity problem with a credit card attached. As Island puts it, an advertising account is a spending account, and one manager account can reach several client accounts. Those are the accounts this campaign goes after. It also hits workforce identity. The recruitment variants ask people to sign in with a work Google or Okta identity. If you protect those identities with SMS, TOTP or push approval, a live operator can relay the code or prompt.
BitB also defeats the usual user-awareness advice. "Check the URL" fails when the phishing page draws its own URL. The only reliable signal is the real browser origin, and people are bad at checking that under pressure. Origin-bound credentials check it for them. Island's recommendation is direct:
Origin-bound passkeys and hardware-backed authentication remove the reusable password and one-time-code material this platform is built to collect. (Island Research)
What to check in your environment
- Identify who in your organization holds Google Ads manager accounts, Meta or TikTok business accounts, or agency access to client ad accounts. Treat them as a privileged group, and move them to passkeys or hardware security keys first.
- In Okta and Google Workspace, find users and groups that can still satisfy MFA with SMS, TOTP or push alone. This campaign relays all of those. Plan phishing-resistant policies for the groups above.
- Review ad platform accounts for the changes Island lists as signs of compromise: new managers or partners, changed recovery details, and campaigns or spend nobody approved.
- Pull the IOC domains and backend hosts from Island's post into your DNS, proxy or secure web gateway blocklists. Then search recent logs for hits.
- If you have proxy or browser telemetry, hunt for the patterns Island names:
google_uid, repeated password fields, calls toapi.ipify.orgoripapi.co, the/api/send/ipand/api/create/userpaths, and Socket.IO connections to unrelated Railway or Render hosts. - Update awareness material for marketing and agency staff. Unknown AI "beta" ad integrations are account-access requests. Users should verify them on the vendor's official site, and they should not trust an address bar drawn inside a page.
- Check Okta and Google sign-in logs for affected users. Look for MFA challenges followed by sessions from unfamiliar IPs or devices, especially after someone reports a "Connect" prompt.