Your 2FA Cannot Stop These Fake AI Ad Tools From Stealing Your Ad Account

The Login Screen You're Looking At Isn't Real

A fake popup is not a new trick. But this one is different. It loads inside your actual browser window, displays a real-looking address bar showing accounts.google.com, and a live human being on the other end decides what you see next. By the time you type your authenticator code, it's already gone.

That is the attack researchers at Island Security uncovered and reported on October 6, 2026. It targets founders, agency staff, media buyers, and anyone managing paid advertising across multiple client accounts.

How Does the Browser-in-the-Browser Attack Actually Work?

The attack starts with a fake website. One example, museads.ai, appeared online on September 16, 2026, just days after Meta launched its own AI ads tool called Muse. The site described itself as "Your AI ads manager for paid media workflows." It looked credible, timely, and useful.

Similar sites impersonate ChatGPT, Gemini, Claude, Perplexity, and Manus, all framed as AI-powered advertising tools. The timing is deliberate. These are names you trust and tools you might actually want to try.

You land on the site. You click the Connect button to link your Google Ads or Meta Business account. A popup appears. The address bar in that popup shows accounts.google.com. The padlock is there. Everything looks right.

The popup is not real. It is a browser-in-the-browser (BitB) attack, a technique that renders a convincing fake browser window inside the page you are already on. You never left the phishing domain. The "address bar" you are reading is an image.

Why Your Two-Factor Code Doesn't Save You

Here is where this campaign is genuinely different from most phishing. A human attacker is watching your session in real time.

When you type your password, they see it. When you complete an MFA step, they immediately relay your credentials to the real Google or Meta login, then watch what challenge comes back. They then choose which screen to show you next: an authenticator app prompt, a Google push notification, an Okta approval request. If you type a code and they want to extract a backup, they show you a "wrong code" error and wait for you to try again.

Your 2FA code has a short expiration window, usually 30 seconds. A live operator doesn't need to break cryptography. They just need to relay what you type fast enough. The math works in their favor.

This is not an automated script. It is a human sitting at a dashboard, running your login like a customer service session, except the product they are selling is your account.

Who Gets Targeted and What Happens Next

Island Security found that the platform specifically targets agency staff, media buyers, and managers who control multiple ad accounts at once. That makes sense from an attacker's perspective. One compromised login can mean access to dozens of client accounts and tens of thousands of dollars in daily ad spend.

Stolen accounts follow one of two paths. The attacker either drains them immediately through fraudulent ad campaigns, running ads for scams, counterfeit goods, or phishing pages on your budget. Or they sell access on dark-web markets where buyers pay a premium for aged, high-spend accounts with clean histories.

The research was published by Island Security and covered by The Hacker News and BleepingComputer on October 6, 2026.

What to Do Right Now

1. Treat any popup login prompt as suspicious by default. A legitimate platform that needs your Google or Meta credentials will redirect your full browser tab to the login page, not open a popup. If you see a floating window with a login form, close it and navigate to the platform directly through a new tab.

2. Switch to passkeys for Google and Meta wherever possible. Passkeys use cryptographic keys tied to your device. They cannot be phished because there is no code or password to relay. Even a live attacker watching your session in real time cannot extract anything useful. Both Google and Meta support passkeys today. Set them up now.

3. Use hardware security keys for your most critical accounts. A FIDO2 hardware key (like a YubiKey) is bound to the legitimate domain. It refuses to authenticate on a fake site even if you don't notice the deception. For accounts managing significant ad spend, this is the strongest protection available and costs under fifty dollars.

4. Audit who has access to your ad accounts. Go into Google Ads and Meta Business Manager right now and review every user with admin or billing access. Remove anyone who no longer needs it. Reduce the blast radius if an account does get compromised.

5. Set up spending limits and alerts. Both Google Ads and Meta let you configure daily budget caps and email alerts for unusual spend. These do not prevent a breach, but they limit the damage window and give you a faster signal that something is wrong.

6. Verify new AI advertising tools before connecting any account. Before clicking Connect on any platform claiming to be an AI ads tool, search the company name plus "scam" or "phishing" in a separate tab. Check the domain registration date. A site that appeared this week and asks for your Google credentials deserves serious skepticism.

7. Tell your team. If you have anyone managing ads on your behalf, send them this post. The attack specifically targets people who manage accounts for others because they have broader access and may be less suspicious of tools their clients ask them to try.

The fundamental problem here is not that your 2FA is broken. The problem is that 2FA was designed to stop automated attacks, and this one is not automated. The attacker is not running a script. They are sitting in a chair, watching you type, and making judgment calls.

The tools you rely on to feel secure were built for a different threat model. That model is no longer the only one.

Do this now:

• Enable passkeys on Google and Meta
• Add a FIDO2 hardware key to your most important accounts
• Review and tighten ad account access
• Set spending alerts so you know within minutes if something goes wrong

Sources

• thehackernews.com
• bleepingcomputer.com