Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes

Domainaccount-sync-data.comAdvertising phishing domainDomainads-claude-beta.comAdvertising phishing domainDomainads-claude.comAdvertising phishing domainDomainads-team-openai.comAdvertising phishing domainDomainadsmistral.comAdvertising phishing domainDomainadvertising-chatgpt.comAdvertising phishing domainDomainadvertising-gemini.comAdvertising phishing domainDomainai-ads-platform.comAdvertising phishing domainDomainai-brand-safety.comAdvertising phishing domainDomainanthropic-ads-beta.comAdvertising phishing domainDomainanthropic-ads-marketing.comAdvertising phishing domainDomainanthropic-ads.comAdvertising phishing domainDomainanthropic-beta-ads.comAdvertising phishing domainDomainanthropic-crm-1.comAdvertising phishing domainDomainanthropic-sponsored.comAdvertising phishing domainDomainbeta-anthropic.comAdvertising phishing domainDomainbeta-chatgpt.comAdvertising phishing domainDomainbeta-gemini-ads.comAdvertising phishing domainDomainbeta-manus.comAdvertising phishing domainDomainbeta-perplexity.comAdvertising phishing domainDomainbusiness-gemini.comAdvertising phishing domainDomainchatgpt-advertise.comAdvertising phishing domainDomainchatgpt-advertisement.comAdvertising phishing domainDomainchatgpt-beta.comAdvertising phishing domainDomainchatgpt-brief.comAdvertising phishing domainDomainchatgpt-briefing.comAdvertising phishing domainDomainchatgpt-monday-brief.comAdvertising phishing domainDomainclaude-ads-beta.comAdvertising phishing domainDomainclaude-ads-invitations.comAdvertising phishing domainDomainclaude-ads-portal.comAdvertising phishing domainDomainclaude-ads.aiAdvertising phishing domainDomainclaude-advertisement.comAdvertising phishing domainDomainclaude-advertisers.aiAdvertising phishing domainDomainclaude-advertisers.comAdvertising phishing domainDomainclaude-beta-invite.comAdvertising phishing domainDomainclaude-beta.comAdvertising phishing domainDomaincursor-ads.comAdvertising phishing domainDomainescrow-ads.comAdvertising phishing domainDomaingemimi-ads.comAdvertising phishing domainDomaingemini-ads-ai.comAdvertising phishing domainDomaingemini-ads-invite.comAdvertising phishing domainDomaingemini-ads-team.comAdvertising phishing domainDomaingemini-ads.aiAdvertising phishing domainDomaingemini-advertisers.comAdvertising phishing domainDomaingemini-beta-invitations.comAdvertising phishing domainDomaingemini-beta-invites.comAdvertising phishing domainDomaingemini-business.comAdvertising phishing domainDomaingemini-google-ads.comAdvertising phishing domainDomaingemini-invitation.comAdvertising phishing domainDomaingemini-invitations.comAdvertising phishing domainDomaingennini-ads.comAdvertising phishing domainDomaingoogle-ads-sync.comAdvertising phishing domainDomaininvitation-anthropic.comAdvertising phishing domainDomainleaks-entry.comAdvertising phishing domainDomainleaksentry-security.comAdvertising phishing domainDomainlink-mcc.comAdvertising phishing domainDomainmanus-meta.imAdvertising phishing domainDomainmanusbymeta.comAdvertising phishing domainDomainmanusmeta.imAdvertising phishing domainDomainmcc-account-sync.comAdvertising phishing domainDomainmcc-invitation.comAdvertising phishing domainDomainmcc-safety.comAdvertising phishing domainDomainmcc-security.comAdvertising phishing domainDomainmcc-verification.comAdvertising phishing domainDomainmetamanus.imAdvertising phishing domainDomainmonday-brief-claude.comAdvertising phishing domainDomainmuseads.aiAdvertising phishing domainDomainopenai-ads.aiAdvertising phishing domainDomainopenai-advertisers.comAdvertising phishing domainDomainopenaiadsteam.comAdvertising phishing domainDomainperplexity-advertising.comAdvertising phishing domainDomainperplexity-beta-ads.comAdvertising phishing domainDomainperplexity-beta.comAdvertising phishing domainDomainsafety-mcc.comAdvertising phishing domainDomainsecurity-ads.comAdvertising phishing domainDomainsecurity-mcc.comAdvertising phishing domainDomainsemrush-ai.comAdvertising phishing domainDomainsemrushads-ai.comAdvertising phishing domainDomainsponsored-gemini.comAdvertising phishing domainDomainsync-account-invite.comAdvertising phishing domainDomainsync-account.comAdvertising phishing domainDomainsync-ads-account.comAdvertising phishing domainDomainsync-ads.comAdvertising phishing domainDomainsync-business.comAdvertising phishing domainDomainsync-mcc-account.comAdvertising phishing domainDomainsync-mcc-data.comAdvertising phishing domainDomainsync-mcc-team.comAdvertising phishing domainDomainsync-tiktok.comAdvertising phishing domainDomainverification-security.comAdvertising phishing domainBackend hostadsclaudeback-production.up.railway.appAdvertising campaign backendBackend hostanthropicadsback.onrender.comAdvertising campaign backendBackend hostbackend-j02u.onrender.comAdvertising campaign backendBackend hostbackend-production-6d75.up.railway.appShared advertising, refund and recruitment backendBackend hostbackend-tg0j.onrender.comAdvertising campaign backendBackend hostchatgptadsback-production.up.railway.appAdvertising campaign backendBackend hostchatgptadsback.onrender.comAdvertising campaign backendBackend hostclaudeadsback-production-67c1.up.railway.appAdvertising campaign backendBackend hostclaudeadsback-production.up.railway.appAdvertising campaign backendBackend hostgeminiback-5j1n.onrender.comAdvertising campaign backendBackend hostgeminiback-production.up.railway.appAdvertising campaign backendBackend hostjust-cooperation-production-f159.up.railway.appAdvertising campaign backendBackend hostmanus2back-production.up.railway.appAdvertising campaign backendBackend hostmanusback-bahk.onrender.comAdvertising campaign backendBackend hostmanusback-production.up.railway.appAdvertising campaign backendBackend hostmanusback.onrender.comAdvertising campaign backendBackend hostmbackend-mdye.onrender.comAdvertising campaign backendBackend hostmuseadsback-production.up.railway.appAdvertising campaign backendBackend hostsemrushback.onrender.comAdvertising campaign backendBackend hostsyncgadsback.onrender.comAdvertising campaign backendBackend hostsyncgoogleadsback-production-6100.up.railway.appAdvertising campaign backendBackend hostsyncgoogleadsback-production-cde6.up.railway.appAdvertising campaign backendBackend hostsyncgoogleadsback-production.up.railway.appAdvertising campaign backendBackend hostsyncgoogleadsback.onrender.comAdvertising campaign backendBackend hosttbackend-production-39ca.up.railway.appAdvertising campaign backendDomainconfirm-payments.comRefund phishing domainDomainpayment-confirm.comRefund phishing domainDomainpayment-confirmation.comRefund phishing domainDomainpayment-confirmations.comRefund phishing domainDomainpayment-sync.comRefund phishing domainDomainpayments-sync.comRefund phishing domainDomainrefund-advertisers.comRefund phishing domainDomainsync-billing.comRefund phishing domainDomainsync-payment.comRefund phishing domainDomainsync-payments.comRefund phishing domainDomainadeccohr-calendly.comRecruitment phishing domainDomainadeccohr-jobs.comRecruitment phishing domainDomainapple-career.comRecruitment phishing domainDomainnikehr-jobs.comRecruitment phishing domainDomaintalent-louisvuitton.comRecruitment phishing domainBackend hostnikear.onrender.comRecruitment campaign backendBackend hostzero39172-391920.onrender.comRecruitment campaign backendDomaincareers-interview.comRecruitment phishing domainDomainferrar.careers-interview.comRecruitment phishing domainDomainferrari-invite.comRecruitment phishing domainDomainredbullapply.careers-appointment.comRecruitment phishing domainDomaintesla-careerapplication.comRecruitment phishing domainBackend hostmango-back.onrender.comRecruitment campaign backendLegitimate domainaccounts.google.comSpoofed address-bar destination, not attacker infrastructureLegitimate serviceapi.ipify.orgIP lookup service used in profiling; not independently maliciousLegitimate serviceipapi.coIP information service used in profiling; not independently maliciousAPI path/api/create/userCreates a victim recordAPI path/api/send/ipReceives device and IP profiling informationState fieldgoogle_uidClient-pattern detection artifactState fieldpassword_oneStores the first password submissionState fieldpassword_twoStores the second password submissionState fieldpassword_threeStores the third password submissionControl eventadd-userPlatform control-vocabulary artifactControl eventupdate-userPlatform control-vocabulary artifactControl eventoperator-commandDelivers operator instructionsControl eventtelegram-commandDelivers Telegram-linked instructionsOperator command/passwordRequests another passwordOperator command/2faRequests an SMS codeOperator command/authAppRequests an authenticator codeOperator command/googlePromptDisplays a Google approval promptOperator command/googleQrVerifyDisplays a supplied QR payloadOperator command/verifyTapDisplays a supplied tap numberOperator command/oktaApproveDisplays an Okta push requestOperator command/oktaAuthAppRequests an Okta authenticator codeOperator command/wrong2faRejects the current authentication codeOperator command/doneCompletes the phishing flowOperator command/banSuppresses the page for the visitorGitHub repositoryrecruiterid/teslanewnewneExposed recruitment frontend sourceGitHub repositoryrecruiterid/newnewteslaExposed recruitment backend sourceGitHub accountreudisacePublished related recruitment builds