Fake AI Ads Phishing Uses Browser-in-the-Browser and Human Operators to Capture Credentials and MFA Codes

By Cyber-Security & Threat Intelligence Desk
Published: October 24, 2023

1. Main Facts: The Evolution of Interactive Credential Harvesting

In an alarming escalation of social engineering tactics, cybersecurity researchers have uncovered a sophisticated, human-operated phishing campaign targeting businesses, advertising agencies, and marketing professionals. The threat actors behind this campaign utilize deceptive lures centered around cutting-edge artificial intelligence (AI) advertising management tools, enticing victims with promises of automated campaign optimization and advanced analytics.

However, once users take the bait, they are thrust into a meticulously crafted trap that combines technical deception with real-time manipulation. Rather than relying solely on automated static landing pages, these attackers employ "Browser-in-the-Browser" (BitB) techniques—rendering realistic, fake browser windows inside the victim’s actual browser viewport—and leverage live human operators via WebSockets (specifically Socket.IO) to dynamically direct screen transitions.

This hybrid approach allows cybercriminals to adapt in real time, tricking unsuspecting targets into surrendering their primary login credentials, one-time SMS or authenticator application codes, and even high-security push notifications from major Identity Providers (IdPs) like Google and Okta.

According to threat intelligence reports—notably from enterprise browser security firm Island—the identical underlying infrastructure has been weaponized across multiple deceptive vectors, including corporate refund schemes and recruitment lures. However, the AI advertising variant has proven particularly devastating due to the high-value permissions typically associated with enterprise marketing accounts.

2. Chronology: The Anatomy of an AI-Ad Phishing Attack

While the initial delivery vectors can vary—spanning spear-phishing emails, malicious search engine advertisements, and compromised social media invitations—the sequence of events once a user interacts with an AI advertising lure follows a carefully orchestrated playbook:

Phase 1: The Lure and Initial Access (T1566.002)

Victims receive targeted communications or encounter promotional links inviting them to beta-test or manage campaigns through a newly minted, revolutionary AI-powered advertising portal. Capitalizing on the current gold rush surrounding generative AI tools, the branding mimics legitimate, high-profile technology platforms and ad-management dashboards.

Phase 2: Rendering the Trap via Browser-in-the-Browser (BitB)

Upon clicking the link, the user arrives at a seemingly authentic third-party landing page. When the user attempts to log in—often via a "Sign in with Google" or corporate single sign-on (SSO) button—a pop-up window appears. Unlike a genuine operating system or browser pop-up, this is a meticulously crafted fake browser window rendered entirely within the webpage using HTML and CSS. The address bar displays a seemingly secure, legitimate URL, completely deceiving the user into believing they are securely authenticating.

Phase 3: Real-Time Human Operation and Input Capture (T1056.003)

Once the victim types their username and password into the fraudulent form, the data is instantly transmitted to an attacker-controlled backend. Simultaneously, a human operator monitoring the session via a command-and-control (C2) interface evaluates the submission. Utilizing real-time communication protocols like Socket.IO, the operator manually dictates the next screen transition.

If the account is protected by Multi-Factor Authentication (MFA), the human operator dynamically switches the fake UI to prompt the user for:

• An SMS-based One-Time Password (OTP).
• A time-based one-time password (TOTP) from an authenticator app.
• Approval for an out-of-band push notification (e.g., Okta Verify or Google Prompts).

Phase 4: Session Hijacking and Post-Exploitation

The live operator immediately inputs the captured MFA codes or waits for the victim to approve the push notification on their mobile device. Once authentication succeeds, the threat actor gains complete access to the victim’s session, allowing them to pivot deeper into corporate networks, manipulate active advertising budgets, or siphon sensitive client data.

3. Supporting Data & Technical Mapping

The sophistication of this campaign lies in its integration of modern web technologies to bypass traditional security controls. Security researchers have mapped these techniques directly to the MITRE ATT&CK framework to help organizations better understand and defend against the threat.

MITRE ATT&CK Framework Mapping

Observable Logs and Indicators of Compromise (IoCs)

Security Operations Centers (SOCs) investigating potential exposure should monitor for specific anomalous behaviors:

• WebSocket Traffic: Unexpected or persistent Socket.IO connections originating from corporate browsers to unverified or newly registered external domains.
• IdP Sign-In Anomalies: Successful authentication logs showing rapid geographic shifts or mismatched User-Agent strings, coupled with authentic device fingerprints due to session proxying.
• Domain Registration Patterns: Newly minted domains featuring a combination of AI keywords (e.g., ai-ads, ad-pilot, genai-media) alongside established brand names.

4. Official Responses and Industry Guidance

As reports of human-operated, BitB phishing campaigns surge, cybersecurity agencies and enterprise security vendors are issuing urgent warnings. Traditional security awareness training—which typically advises users to "look at the address bar for HTTPS and the correct domain"—is no longer sufficient when dealing with advanced BitB attacks, as the fake address bar resides inside the web page content and can display any arbitrary text.

Major Identity Providers have reiterated the necessity of adopting phishing-resistant MFA, such as FIDO2/WebAuthn-based security keys (e.g., YubiKeys) or passkeys. Unlike SMS, TOTP codes, or standard push notifications—which can be intercepted or maliciously approved in real time by human operators—cryptographic hardware keys bind the authentication session to the exact origin of the browser, rendering BitB and human-in-the-middle attacks ineffective because the key will refuse to sign a challenge originating from a fraudulent domain.

Furthermore, enterprise browser vendors like Island emphasize that perimeter security is no longer adequate. Organizations must implement secure enterprise browsers capable of isolating web sessions, inspecting DOM structures for embedded pop-up manipulation, and restricting unauthorized socket connections.

5. Implications for SOCs, Organizations, and Marketing Teams

The intersection of artificial intelligence hype and human-operated phishing poses a unique threat landscape for modern enterprises, carrying profound implications for security operations centers (SOCs) and business units alike.

The Advertising Agency Vulnerability

Marketing agencies and enterprise brand managers are prime targets for this campaign. These individuals frequently manage substantial advertising budgets, possess elevated permissions across multiple client ad accounts (such as Meta, Google Ads, and LinkedIn), and are constantly evaluating new SaaS tools to stay competitive.

If an agency account is compromised, the impact rarely stops at a single user. Threat actors can rapidly pivot across linked client profiles, misusing ad spend to promote illicit goods, run cryptocurrency scams, or exfiltrate proprietary marketing strategies and customer lists.

Challenges for SOC Analysts

For SOC teams, detecting these campaigns is exceptionally difficult. AI-related software tools are proliferating rapidly, making it nearly impossible for administrators to manually verify the legitimacy of every newly adopted SaaS platform. Furthermore, because the phishing pages rely on legitimate login flows proxied by human operators, traditional security gateways often misclassify the traffic as legitimate interactive user sessions.

Recommended Defensive Strategies

To mitigate the risks posed by fake AI ad portals and human-operated BitB attacks, organizations should enforce the following measures:

1. Mandate Phishing-Resistant MFA: Transition away from SMS, OTP, and basic push notifications in favor of FIDO2 hardware tokens or passkeys, which inherently block credential relay and BitB attacks.
2. Deploy Enterprise Browsers or Advanced Extension Controls: Utilize security tools capable of detecting anomalous DOM modifications, script-injected pop-ups, and unauthorized cross-origin iframe rendering.
3. Unified Monitoring: Monitor IdP sign-in logs alongside ad platform permission changes and spending alerts. Sudden shifts in advertising configurations should trigger automated containment protocols.
4. Enhanced Employee Training: Educate high-risk personnel—particularly marketing, procurement, and executive teams—about the mechanics of Browser-in-the-Browser attacks, emphasizing that clean-looking address bars inside webpage windows cannot be trusted.

As cybercriminals continue to professionalize their operations by incorporating real-time human decision-making and capitalizing on emerging technological trends, organizations must match this agility with advanced, cryptographic defenses and rigorous identity governance.