The lure imitates an AI vendor's advertising or beta onboarding. Within an attacker-controlled webpage, a browser-in-browser overlay presents a sign-in dialog resembling a Google authentication window. The visual resemblance makes page-origin content appear to be identity-provider UI, blurring the boundary between the website and a trusted login flow. ANY.R…
Inspect the ClaimsCase · DiggingBeagle record
Fake AI advertising beta programs phish Google sign-in with browser-in-browser
A phishing branch impersonates advertising programs at AI brands, rendering a Google-like login pop-up within the attacker page and reporting visit data to its backend.
Scope
Advertising onboarding invitation to fake identity dialog
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is research_demonstration; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-FAKE-AI-ADS-BITB-01 · ANY.RUN: counterfeit AI products and malicious onboarding campaigns
At a glance
Actual Google account takeovers and campaign monetary losses were not established by sandbox visits.
Limits and uncertaintyFull account
The lure imitates an AI vendor's advertising or beta onboarding. Within an attacker-controlled webpage, a browser-in-browser overlay presents a sign-in dialog resembling a Google authentication window. The visual resemblance makes page-origin content appear to be identity-provider UI, blurring the boundary between the website and a trusted login flow.
ANY.RUN reports 57 public analyses for this branch, not verified counts of stolen credentials or account takeovers. This is phishing using AI-company branding; the central security mechanism is a counterfeit login surface, not model-generated output or an AI service compromise. No direct victim-loss metric is supported by the pinned record.
Claims & evidence
CLM-2026-FAKE-AI-ADS-BITB-01ANY.RUN describes 57 sandbox analyses of Claude, Gemini, Perplexity and Manus advertising-themed browser-in-browser lures with fake Google credential flows between July and September 2026.supported
Basis: reported finding
- supportsANY.RUN: counterfeit AI products and malicious onboarding campaignsprimary disclosure
Section Run Ads on Claude
Unknowns and contradictions
- Actual Google account takeovers and campaign monetary losses were not established by sandbox visits.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153