BitB Platform Harvests AI Ad Credentials via Real-Time Operator MFA Steering
A coordinated phishing operation uses browser-in-the-browser attacks and live operators to steal credentials and MFA codes from users of fake AI advertising portals. The kit supports six AI brands and multiple identity providers with granular real-time control. Evidence points to an adaptive, human-driven campaign timed to AI product launches rather than mass automated phishing.
The platform deploys six branded lures, each with tailored copy such as Monday Google Ads briefs or MCC-linked client support. Victims clicking Connect trigger a Socket.IO-driven BitB window that spoofs accounts.google.com or Okta tenants while the real browser stays on museads.ai and similar domains. Device fingerprinting occurs at /api/send/ip before an operator selects the next challenge via events named operator-command and telegram-command. Island researchers documented 14 distinct MFA flows the operator can invoke, including Google number matching, Okta push approval and wrong-2FA rejection. The same parser handles both Telegram and in-page commands, confirming a single human controller steers sessions in real time rather than relying on scripted automation. This campaign exploits the post-2023 surge in AI marketing budgets and the rapid release cadence of new AI products, timing domains like museads.ai within days of Meta’s Muse launch. The pattern mirrors earlier human-operated kits against Google Ads refund scams but adds brand-specific pitch decks and cross-platform ad-account targeting. Next indicators to watch are domain registrations matching newly announced AI ad tools and anomalous traffic to Socket.IO endpoints on .ai domains. Defenders should monitor for BitB canvas anomalies and require hardware-bound MFA where possible.
Island researchers: At least two additional AI-branded domains register within 45 days and reuse the same Socket.IO command structure.
Sources (2)
- [1]Primary Source(https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html)
- [2]Supporting Source(https://island.io/research/ai-ads-phishing-2026)