Azerbaijan's National Cybersecurity Agency has warned of a new phishing campaign in which attackers are using the names of popular artificial intelligence services to steal passwords and one-time verification codes.
According to Report, the agency said the campaign involves the creation of fake advertising portals impersonating AI services such as ChatGPT, Gemini, Claude, Perplexity, Meta Muse and Manus.
The websites purportedly offer tools to manage advertising campaigns, analyse advertising expenditure and connect business accounts to various services. In reality, their aim is to obtain users' login credentials and one-time verification codes.
Potential victims are presented with fake interfaces that closely resemble genuine login pages.
Once users enter their usernames and passwords, the information is transmitted to the attackers. Victims are then asked to provide a one-time verification code to give the attackers access to their accounts. As a result, even multi-factor authentication may not always protect an account if the user has been deceived.
The investigation found that the campaign targets specific professional groups, including advertising account administrators, media buyers and employees of advertising agencies.
Gaining control of such accounts can result in financial losses, unauthorised advertising campaigns and the restriction of account owners' access to their accounts.
Experts also identified other phishing schemes using the same infrastructure. These include fake websites promising refunds on behalf of Google Ads and fraudulent job pages impersonating various companies.
According to the agency, paid online advertisements are among the methods used to distribute links to fraudulent websites.
The National Cybersecurity Agency urged users to follow these security guidelines:
-
Connect AI services and other digital tools to business accounts only through official websites and trusted integration channels.
-
Check the URL in the browser's main address bar rather than the address displayed within a login window on a webpage.
-
Do not click links in suspicious emails or accept invitations purportedly sent by well-known companies without verifying their authenticity.
-
Enter one-time verification codes only when logging into an account on your own initiative, and never share them with anyone.
"If you suspect that you have entered your credentials on a phishing page, change your password immediately, terminate active sessions and check the list of account administrators. You should also review granted permissions, payment details and recent transactions," the statement said.