Fake AI Chatbot Ads Used to Harvest Credentials and MFA Codes

Cybersecurity researchers have disclosed a sophisticated, human‑operated phishing platform that creates counterfeit advertising portals for popular artificial intelligence chatbots such as Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexy, Meta Muse and Manus.

The fake portals are designed to look like legitimate marketing pages that promise campaign optimisation, spend audits and direct connections to business accounts, but they actually capture users' credentials and MFA codes before forwarding them to the attackers.

According to The Hacker News, the operation relies on real people to manually harvest the stolen information, allowing the actors to bypass many automated detection mechanisms and increase the success rate of their phishing campaigns.

Australian organisations and students are not immune to this threat; recent reports indicate that similar AI‑driven phishing attempts have been observed targeting companies in Sydney and Melbourne, prompting security teams to reinforce email and web filtering controls in line with the Australian Cyber Security Centre's guidance.

Professionals seeking to defend against such attacks should consider formal security training, and providers like Wepro Technology in Darwin now offer Security+ certification courses that cover credential protection, MFA best practices, and incident response for emerging phishing techniques.