A phishing platform impersonating ChatGPT, Gemini, and Claude as advertising tools is stealing ad account credentials from the people most eager to adopt AI. The fastest-growing brands in technology are now the fastest-growing impersonation targets.
ChatGPT reached 100 million users in two months. No product has ever built consumer recognition that quickly, and no brand has ever created an impersonation surface that quickly. The trust that businesses now place in AI tools, the urgency to integrate them, the pressure from leadership to find competitive advantage through them, is exactly the kind of trust that brand impersonation exploits best.
On October 6, researchers at Island published findings showing what that looks like in practice: a human-operated phishing platform that impersonates advertising products for six AI brands: OpenAI’s ChatGPT, Google’s Gemini, Anthropic’s Claude, Perplexity, Meta’s Muse, and Manus. The platform presented itself as an AI-powered ads manager for paid media workflows, promising Google Ads briefings, manager-account support, and campaign optimization. Over a three-month observation period ending in August 2026, Island identified roughly 850 paid-ad landings, 26 lookalike ChatGPT destinations, and 71 Google Ads campaign IDs tied to the operation.
The targets were advertising account administrators, media buyers, and agency staff: the people with credentials that unlock corporate ad spending.
How the platform worked
The lure pages offered a “Connect” button that launched what appeared to be a Google sign-in window. The window was fabricated. Using a technique called browser-in-the-browser phishing, the platform rendered a fake login interface inside the webpage, complete with a trusted-looking URL bar showing accounts.google.com and a lock icon. The actual browser remained on the attacker’s domain.
Behind the interface, a live operator managed each session. The platform collected credentials in stages, storing up to three password attempts in separate fields so the operator could reject an entry and request another without losing what had already been submitted. When the victim’s account required multi-factor authentication, the operator could hold them on a waiting screen, request an SMS or authenticator code, display a Google approval prompt, or trigger an Okta authentication screen. The credential harvesting was not automated. It was a conversation, guided by a person watching it happen in real time.
Island found that the AI ad lures were part of a broader operation that also included Google Ads refund claim pages and recruitment-themed sites impersonating Tesla, Louis Vuitton, Nike, and Adecco. The fake ChatGPT destinations alone numbered 26, with 20 more using Claude or Anthropic names and 17 using Gemini. One platform, many brands, all running the same playbook.
Why AI brands are uniquely effective as lures
The impersonation worked because the offer was plausible. AI companies are actively launching advertising products. Google runs AI-powered ad tools through its existing platform. Meta promotes AI-generated ad creative. OpenAI has signaled interest in advertising as a revenue stream. A media buyer who receives an invitation to connect their ad account to a new AI-powered campaign manager is encountering something that sounds like the announcements they read about every week.
This is what separates AI impersonation from earlier waves. When attackers impersonate a bank or a retailer, the victim is defending something they already have: an account, a balance, a credential. When attackers impersonate an AI brand, the victim is reaching for something they want: a competitive edge, a productivity gain, an advantage their peers may already have. The psychological dynamic shifts from caution to appetite, and appetite makes people move faster and question less.
The speed compounds the exposure. Traditional brands build recognition over years, which gives security teams time to develop monitoring and response programs. AI brands achieve household recognition in weeks, and the impersonation infrastructure can be built as fast as the brand awareness that fuels it.
The ad account is the prize, and the pipeline continues from there
The choice of target reveals the campaign’s economics. An advertising account administrator holds credentials that control corporate ad spend, audience data, and campaign infrastructure. A compromised Google Ads account does not just expose the victim’s organization. It becomes a tool for running fraudulent ads impersonating other brands, which connects this campaign to the broader ad auction impersonation problem we have documented separately.
The pipeline works in stages. The AI brand lure captures the credential. The credential unlocks the ad account. The ad account runs impersonation ads for retail brands, financial institutions, or other targets. Each stage exploits a different organization’s trust, and the AI brand impersonation is just the first link in the chain.
The Bottom Line
Wherever trust concentrates, impersonation follows. Banks were the first generation of heavily impersonated brands. Retailers followed. Payment platforms after that. AI companies are the current generation, and they reached the top of the trust curve faster than any brands before them. The Island research documents what that velocity looks like when attackers exploit it: a phishing platform wearing six AI brands simultaneously, targeting the people whose credentials unlock the most downstream damage. The brands that build trust the fastest create impersonation surfaces the fastest, and the organizations monitoring for that exposure cannot afford to wait for the trust to mature before the protection does.
Key Takeaways
Yes. Island researchers documented a human-operated phishing platform using fake ChatGPT advertising products, along with fake versions of Gemini, Claude, Perplexity, Meta Muse, and Manus, to steal credentials and MFA codes from ad account administrators. The operation ran 850 paid-ad landings and 71 Google Ads campaign IDs over three months ending in August 2026. ChatGPT, Gemini, and Claude are not being used to generate phishing. Their brand names are being used as the lure.
AI phishing refers to phishing attacks that impersonate AI brands and tools to steal credentials. In the campaign documented by Island, fake advertising products branded as ChatGPT, Gemini, and Claude prompted victims to connect their Google Ads accounts through a fabricated login window rendered inside the webpage, a technique called browser-in-the-browser phishing. A live operator managed each session, collecting passwords in stages and guiding victims through multi-factor authentication prompts in real time.
AI companies are actively launching advertising and productivity products, making offers like “AI-powered ads manager” plausible to media buyers under pressure to integrate AI into their workflows. Unlike bank or retailer impersonation, where the victim defends something they have, AI impersonation exploits appetite for something the victim wants: a competitive advantage. The urgency to adopt AI makes targets move faster and question less.
A compromised advertising account becomes a tool for running fraudulent ads impersonating other brands. The AI brand lure captures the credential, the credential unlocks the ad account, and the ad account runs impersonation campaigns targeting retail brands, financial institutions, or other organizations. Each stage exploits a different organization’s trust.
Verify any AI advertising product directly through the vendor’s official website rather than clicking links in ads or emails. Legitimate AI advertising tools from Google, Meta, and OpenAI are accessed through existing platform dashboards, not through standalone sign-up pages. Any page requesting Google Ads credentials through a pop-up login window outside the official Google domain should be treated as a phishing attempt. Island documented 26 fake ChatGPT destinations and 17 fake Gemini destinations in one operation alone.
