What actually happened
Island's 6 October research documented a live, human-operated phishing platform masquerading as AI-powered advertising software. The operators built believable landing pages that borrowed the branding of ChatGPT, Claude, Gemini, Perplexity and Meta's Muse. Each offered something a media buyer might want: campaign analysis, spend audits or a better way to manage advertising accounts. The critical interaction was a Connect button.
Clicking that button displayed a counterfeit sign-in window inside the webpage. It could look like a separate Google browser window, complete with a trusted address and lock icon, although the real browser remained on the attacker's website. Island calls this a browser-in-the-browser technique. The operators collected password attempts, device information and authentication responses and could choose which MFA challenge appeared next.
Island says it observed hundreds of submissions and found evidence of operator-controlled flows for Google, Meta, TikTok and Okta. That establishes a documented active campaign, rather than a claim that every AI-themed ad integration is malicious. The striking detail is how closely the fake products copy the actual language used by advertisers, including manager accounts, campaign performance and account connections.
Why a small team cares
Consider a small performance-marketing agency managing Google Ads accounts for twelve local businesses. Its manager account may connect the team's login to a dozen client billing profiles, active campaigns and accumulated account permissions. One stolen privileged identity can become a problem for every client connected through it. Recovery and client communication can cost far more than any individual fraudulent campaign.
The entry point is familiar. An account manager receives what looks like an invitation to a new AI campaign assistant, opens the link and sees an attractive dashboard promising automated weekly reports. The login window says accounts.google.com, so the manager enters a password and then an authenticator code. But the trusted address is only artwork inside the attacker's page. A human operator can use that information during the same session.
This is why checking the domain means checking the browser's real address bar, not a login window drawn within the site. For administrative accounts, origin-bound passkeys and hardware security keys offer stronger protection than reusable passwords and one-time codes. Agencies also need a clear record of who can add users, approve connections and spend money in each account.
Hype vs useful
The campaign is designed to exploit excitement around new AI integrations. A plausible brand and professional landing page do not establish a relationship with the real vendor. Nor is a conventional MFA prompt sufficient protection when an operator is actively requesting and relaying codes. Island's evidence points to a targeted identity-theft operation; it does not show that the named legitimate AI services themselves were compromised.
The commercial risk is concentrated: a compromised administrator can interrupt campaigns, trigger recovery work and damage multiple client relationships. A small agency does not need a new security platform to reduce its exposure this week. It needs a named integration approver, fewer privileged users and phishing-resistant sign-in. Those controls create a little friction before a connector is enabled, but the potential cost of an unauthorized connection is much higher.
There is no reason to ban AI advertising tools. The useful response is to put the identity and permission checks in front of the Connect button. An agency can recover from a failed AI experiment in an afternoon. Recovering access to twelve compromised advertising accounts is a very different problem.
