The Sign-In Window That Isn't a Window
A new phishing operation opens a Google sign-in window that shows the right address, the right padlock, and the right logo. It is a drawing inside the page. Here's how it works, the ten-second test that exposes it, and where SAFE Portal fits.
You did the careful thing. Before typing your password, you looked at the address. It said accounts.google.com, with the padlock next to it. So you signed in.
The address you checked was part of a drawing.
What researchers found
On October 6, researchers Oleg Zaytsev and Ofek Ronen at the browser security company Island described a phishing operation built on fake AI advertising tools. The sites borrowed names people already trust: ChatGPT, Gemini, Claude, Perplexity, Manus, and Meta's Muse. Each one promised to help advertisers plan a campaign, audit their spending, or write a Google Ads brief. The fake Muse tool appeared on September 16, eight days after Meta introduced the real one.
Every one of these sites was built around a single button: Connect.
How it works, step by step
- You land on a polished AI tool. It carries a familiar name and offers something useful for your ads.
- You click Connect to link your Google account. The same kit has versions for Meta, TikTok, and Okta sign-ins.
- A sign-in window appears. It has a title bar, a padlock, and an address that reads accounts.google.com. It even matches your device: Windows, Mac, iPhone, or Android, light mode or dark.
- You type your password. It goes to the attacker. The platform keeps every attempt.
- A live person takes over. According to Island, a human operator decides what you see next. They can ask for your password again, request a text or authenticator code, trigger an approval prompt on your phone, or show a QR code. If a code doesn't work for them, they reject it and you are asked to try again.
- You wait on a loading screen. While you wait, they are signing in as you.
Why the two-step code didn't help
Nothing about Google's two-step verification was broken. The code worked exactly as designed. It was simply typed into the attacker's page while a person sat on the other end, ready to use it within seconds. A one-time code protects you from someone who has only your password. It does not protect you from handing over both at once.
Who is being targeted, and why it's wider than that
The lures are aimed at people who run advertising: agency staff, media buyers, and the administrators who manage ad accounts for several clients. One of those logins can carry spending authority across every client behind it. Attackers can burn through the ad balance on their own campaigns, sell the account, or add themselves as administrators so that getting it back is much harder than canceling a card.
Island saw hundreds of victim submissions pass through the operation's control channel. That is not the same as hundreds of hijacked accounts, but it shows how many people got as far as typing something in.
The reason this matters beyond advertising: the researchers tied the same machinery to fake job recruitment pages and fake refund pages. "Sign in with Google" is on half the internet. The fake window works the same no matter what the page around it is selling.
The checks that hold
- Try to drag the window off the page. A real sign-in popup is its own browser window. You can drag it past the edge of your browser or resize it. A fake one is trapped inside the page it was drawn on. This takes ten seconds and it is the most reliable test there is.
- Read the real address bar. That is the one at the very top of your browser, not the one inside the page.
- Treat "Connect your account" as handing over keys. A brand-new tool asking to connect your Google, Meta, or TikTok account is asking for account access, not a harmless add-on.
- If you already typed a password or code, change the password from a device you trust, sign out of other sessions, and review your ad accounts for administrators, partners, or campaigns you don't recognize.
- Move to passkeys where you can. A passkey is tied to the real site and will not work on a lookalike.
Where SAFE Portal fits
What it won't do
SAFE Portal can't tell you whether a new AI tool deserves your trust, and it doesn't review your ad accounts for strangers who were added last week. The SAFElist prompt is a pause, not a guarantee: if you choose to add a bad site, you have added it. And a password and code already typed into a fake window on another browser are gone. That calls for a password change, not a browser.
Checking the address is still the right instinct. Just make sure it's the real address bar. SAFE Portal is at SAFEPortal.to, free to try.