Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Fake AI advertising tools are being used to trick workers into connecting Google, Meta, TikTok, and other business accounts through counterfeit sign-in windows. The pages can imitate a trusted login screen, but the window is drawn inside the phishing site; passwords and authentication responses entered there may be exposed to the operators.
What the fake AI advertising sites do
In an October 6, 2026 report, Island security researchers Oleg Zaytsev, Lead Security Researcher, and Ofek Ronen, Security Researcher, described a phishing platform posing as AI advertising products. The lures promised campaign optimization, advertising-spend audits, weekly briefings, or a way to connect business ad accounts. Brands named in the report included ChatGPT, Gemini, Claude, Perplexity, and Manus; Island said operators later added a fake Meta Muse Ads product. Island’s report describes these campaigns and the platform behind them.
As an Amazon Associate I earn from qualifying purchases.
The products were designed to make connecting an advertising account look like an ordinary work task, rather than a suspicious request to type a password into an unfamiliar page. Their central action was a “Connect” button.
How the counterfeit sign-in window works
Clicking Connect did not open the genuine provider’s sign-in page. The phishing page displayed a fake browser window inside the webpage, complete with an address bar showing a trusted-looking origin such as accounts.google.com or an Okta tenant. The real browser remained on the phishing domain. This is known as a browser-in-the-browser attack.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
“Each product was built around the same action: Connect. Clicking it opened a browser drawn inside the real browser. The fake address bar displayed trusted origins such as accounts.google.com or an Okta tenant, while the real browser remained on the phishing domain.”
Island reported that the platform retained password attempts, fingerprinted visitor devices, and let a human operator select which prompt to show next. Supported workflows included Google, Meta, TikTok, and Okta. Depending on the account and flow, a victim might be asked for an SMS code, an authenticator code, a Google approval or QR flow, or an Okta push or authenticator response.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can a fake Google sign-in window steal an MFA code?
Yes. If a person types a one-time code into a counterfeit sign-in flow, an operator may capture or relay it during the active interaction. An approval prompt can also be part of a deceptive flow. That does not make MFA useless: it remains an important account defense. It does mean that a code or approval should only be given in response to a sign-in the user initiated on the real service.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsGoogle has separately warned that some attacks capture session cookies and can bypass MFA. Its June 2026 advisory recommends navigating directly to official websites rather than following suspicious links. Google’s advisory discusses that broader risk; it is distinct from Island’s fake AI advertising-account platform.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to tell whether a sign-in window is real
- Check the actual browser address bar. A familiar address displayed inside a page is not the browser’s real address. Confirm the domain shown by the browser itself.
- Start from the service’s official site. Type its known address or use a trusted bookmark, then sign in and connect accounts from there. Do not rely on a link or embedded window supplied by an unexpected ad tool.
- Treat unexpected codes and approval requests as warning signs. Do not enter a code or approve a prompt you did not trigger yourself.
- Inspect the destination before entering credentials. Google Ads Help advises checking a link’s destination and warns that Google will not ask for sensitive information through an unsolicited message or link. Google Ads account-security guidance explains how to protect and report an account concern.
What to do if you entered your password or an MFA code
- Go directly to the official service. Do not use the suspected phishing page or its links. Secure the account through the service’s genuine website or app.
- Change the exposed password. If you reused it elsewhere, change it on every affected account, using a different, unique password for each service.
- End active sessions and review security activity. Sign out sessions you do not recognize, inspect recent sign-ins and security history, and follow the service’s recovery steps if anything appears unauthorized.
- Contact the service’s official support or security channel. For Google Ads, use its account-protection and suspicious-page reporting guidance. For Meta, TikTok, or Okta, follow the relevant service’s official instructions.
- Tell your organization’s security or account owner. Advertising accounts can affect business campaigns and billing, so notify the person responsible for access and review connected accounts and permissions.
For an exposed OpenAI password or suspected unauthorized access to an OpenAI account, OpenAI recommends changing the password, logging out of active sessions, reviewing security history, and contacting OpenAI Support. Its security guidance also recommends unique passwords, a password manager, and MFA. OpenAI’s account-security guidance includes those steps.
How much activity has been confirmed?
Island said it saw hundreds of submissions to the platform and that the activity was ongoing when its report was published on October 6, 2026. Submissions are not the same as confirmed account takeovers, unique victims, or financial losses; Island did not provide campaign-wide totals for confirmed compromises or losses in the cited report.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The Hacker News reported separate figures from Island’s broader delivery-cluster observations: about 850 paid-ad landings, 26 lookalike ChatGPT destinations, and 71 Google Ads campaign IDs over a three-month observation period ending in August 2026. Those measurements do not represent confirmed victims and should not be attributed to the account-phishing operation alone. The related sponsored-search/ClickFix malware campaign is a separate activity, not the fake AI sign-in platform described here. The Hacker News summary provides the scope for those figures.
Hardening accounts without relying on one control
Use a unique password and a password manager, enable the sign-in protections supported by each service, and review account activity periodically. Where available and supported by the service and your organization, a hardware security key such as a YubiKey security key can add a physical, hardware-backed option. It is not a cure for phishing: users still need to verify the real domain and follow each service’s supported sign-in and recovery process. OpenAI’s guidance recommends using a password manager and references an OpenAI and Yubico YubiKey bundle for eligible users.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
