Zscaler’s ThreatLabz report identified over 413,000 AI-generated phishing pages using browser-in-the-middle (BiTM) attacks. The technique renders a fake browser window inside the real page using HTML and CSS. When users authenticate with MFA, the attacker captures credentials and live MFA codes before they’re submitted to the legitimate service. The user sees a successful login, the URL bar shows the correct domain, and the attacker owns an authenticated session.
An October 2026 campaign targeted ad account managers with fake ChatGPT, Gemini, and Claude sites using this approach.
The architectural problem: when the attacker controls what you see on screen, URL bars and standard verification become irrelevant. The user thinks they’ve logged in successfully, not realizing the attacker already has everything.
Sources: One-Click Compromise: ThreatLabz 2026 Phishing and Initial Access Report
Coverage: AI-Generated Fake Login Pages Are Making Account Takeovers Easier • Fake AI Ad Portals Put Business Logins in a False Window
Related on this blog: [AUTO] Malvertising Chains Trust to Deliver Fake Claude Installers • [AUTO] AI Evasion Techniques Go Mainstream in Phishing • [AUTO] ChatGPT Powered a Fake Think Tank for Russian Disinformation