Azerbaijan's National Cybersecurity Agency has warned of a new phishing campaign. Attackers are masquerading as popular artificial intelligence services to steal passwords and one-time verification codes.
According to FinFly, citing the agency's statement, the campaign involves the creation of fake advertising portals in the name of AI services such as ChatGPT, Gemini, Claude, Perplexity, Meta Muse and Manus.
The sites purport to offer management of advertising campaigns, analysis of ad spending and connection of business accounts to various services. In reality, their goal is to obtain users' credentials and one-time verification codes.
Potential victims are shown fake interfaces that visually resemble genuine login windows.
After a username and password are entered, the information is passed to the attackers. The victim is then asked for a one-time verification code in order to gain access to their account. Thus, even multi-factor authentication is not always able to protect an account if the user has been misled.
The investigation showed that the campaign targets representatives of specific professional groups, including advertising account administrators, media buyers and employees of advertising agencies.
Gaining control over such accounts can lead to financial losses, the placement of advertising without the owner's permission and restriction of their access to account management.
Specialists also discovered other phishing schemes using the same infrastructure. These include fake sites promising refunds in the name of Google Ads, as well as fake job pages created in the name of various companies.
According to the agency, paid online advertisements are among the means used to distribute the fraudulent resources.
The NCA urged users to follow these security rules:
• Connect AI services and other digital tools to business accounts only through official websites and trusted integration channels.
• Check the address in the browser's main address bar, not the one displayed inside the login window on the web page.
• Do not follow links from suspicious emails and do not accept invitations sent in the name of well-known companies without verifying them.
• Enter one-time verification codes only when you have initiated the login yourself, and never share them with anyone.
"If you suspect that you have entered your credentials on a phishing page, immediately change your password, end active sessions and check the list of account administrators. You should also check the permissions granted, payment details and recent transactions," the statement said.
