TL;DR
Scammers are creating fake AI advertising platforms that mimic real Google login pages to steal Google Ads account credentials. These scams use a “browser-in-the-browser” trick to display fake login windows that look genuine, even showing the Google address bar and lock icon. Once scammers have access, they can misuse your advertising budget, change or shut down campaigns, or lock you out of your account.
- Fake AI ad tools impersonate trusted brands and ask to connect to your Google account.
- Scammers use a fake browser window within a webpage to capture your login information.
- Even two-factor authentication can be bypassed with real-time scam operator interaction.
Quick win: Always verify new AI advertising tools by visiting official websites directly and enable strong login protections like two-factor authentication or passkeys to secure your Google Ads account.
Apparently, it’s not enough that Google wants a piece of every advertising dollar you spend. Now scammers are lining up to take a piece, too. On October 6, 2026, cybersecurity researchers at Island exposed a phishing scam in which criminals were creating fake AI advertising platforms and passing them off as products from familiar companies like ChatGPT, Gemini, and Claude. The idea is simple. Lure business owners into signing up for what looks like a useful AI advertising service. Convince them to connect their Google accounts. Then steal their Google login information. Once the criminals have those credentials, they can attempt to break into the victim’s actual Google account, potentially gaining access to their Gmail, Google Ads campaigns, and other connected services. And the way they’re stealing those credentials is particularly sneaky. They’ve figured out how to display a fake Google login window that looks like the real thing, complete with Google’s actual website address.
How Do These Fake AI Advertising Scams Work?
The scammers aren’t simply sending emails asking for your Google password. They’re offering something that sounds genuinely useful. They create professional-looking websites advertising AI-powered marketing tools. These fake platforms might promise to optimize your Google Ads campaigns, generate performance reports, or help manage your advertising accounts. Some even borrow the names and branding of well-known AI companies to make the offers more believable. For example, Island’s researchers uncovered a fake ChatGPT advertising platform that promised weekly Google Ads reports. Another fraudulent platform, impersonating Gemini, offered tools for managing multiple advertising accounts. For a busy business owner who doesn’t have time to constantly monitor advertising campaigns, those features might sound pretty appealing. And that’s precisely what the scammers are counting on. When you try to sign up for one of these services, you’re prompted to connect your Google account. After all, an advertising tool that promises to analyze your Google Ads performance would reasonably need some way to access your advertising data. So you click the “Connect” button. And that’s when the scammers spring their trap.
The Fake Google Login Window Isn’t Really a Browser Window
Normally, when a legitimate service asks you to sign in with Google, you’re taken to Google’s actual login page. Sometimes that appears in a separate browser window. The scammers imitate that familiar process, but with one critical difference. 
Clicking their Connect button doesn’t open Google’s website. Instead, the scam page draws a fake browser window inside itself. It looks like a real pop-up window. It has the familiar Google sign-in screen, an address bar, and even the little lock icon you’d expect to see on a secure website. And the address bar displays accounts.google.com, Google’s legitimate login address. But that address isn’t coming from your browser. It’s just text and graphics that the scammers have placed inside their fake window. Think of it like a movie set. A storefront might look like a real building from the street, complete with windows and a front door. But step around behind it, and you’ll discover it’s just a painted facade. That’s essentially what these scammers have built. You’re looking at a webpage pretending to be a separate browser window. The Google address, the lock icon, and the login form are all part of the illusion. Your actual browser never left the scammer’s website. Security researchers call this a browser-in-the-browser attack. And here’s why it matters. If you type your Google username and password into that fake window, you’re not giving them to Google. You’re handing them directly to the criminals operating the website. The scammers can then use that information to try signing into your real Google account. They may even ask for the verification code Google sends to your phone. Island’s researchers discovered that human operators could control these fake login screens in real time, prompting victims for additional information as needed. So even if you’ve enabled traditional two-factor authentication, you could still be tricked into giving the criminals what they need to get past it. The AI advertising platform was never the real product. It was just the bait to get you to enter your Google credentials into a fake login screen.
Why Are Scammers Interested in Google Ads Accounts?
The scammers aren’t stealing passwords just for the fun of it. A Google account can provide access to all kinds of valuable information and services. But accounts connected to Google Ads are especially attractive because they can control real advertising budgets. Let’s say you’re a plumbing contractor spending $2,000 a month on Google Ads to generate calls for emergency repairs and drain cleaning. If a scammer gets access to the Google account that controls those campaigns, they could potentially:
- Spend your advertising budget on their own campaigns. Your credit card gets charged, but the ads aren’t bringing customers to your business.
- Shut down or change your existing campaigns. Your ads stop generating leads while your competitors keep getting calls.
- Lock you out of your advertising account. They could change permissions, leaving you struggling to regain control.
These are potential consequences of an account takeover, not confirmed outcomes for every victim of this particular operation. And the risk isn’t limited to Google Ads. Island found that the phishing platform could imitate login processes for other services, including Meta and business authentication systems. The common thread is that the criminals are trying to steal access to valuable business accounts by disguising their phishing websites as legitimate AI advertising products.
Am I at Risk if a Marketing Agency Manages My Google Ads?
Yes, although your exposure depends on who has access to the account and how it’s managed. If you work with an advertising agency, you probably aren’t logging into Google Ads every day. Your agency handles the campaigns, budgets, and technical details. However, if you have administrative access to your account, a scammer could still trick you into handing over your Google login information. And if someone at your marketing agency falls for the same scam, they could potentially expose accounts belonging to multiple clients. In fact, advertising agencies are particularly attractive targets because they often manage numerous client accounts from a single Google Ads manager account. That’s why it’s important to work with a marketing company that takes account security seriously, limits unnecessary access, and verifies unfamiliar integrations before connecting them. And if an unfamiliar AI advertising service contacts you about an account your agency manages, there’s a simple solution: forward the offer to your marketing company and let them investigate it. You don’t need to become a cybersecurity expert. You just need to know when to ask someone who understands the risks.
How Can You Protect Your Business From These Fake AI Advertising Tools?
You don’t need to avoid AI advertising tools altogether. You just need to be careful about which services you trust with access to your accounts. Here are three precautions worth taking.
1. Verify New AI Advertising Tools Before Connecting Anything
If you receive an unexpected email inviting you to try a new AI advertising product, don’t automatically trust it because you recognize the company’s name. Instead, visit the company’s official website yourself and verify that the product actually exists. Don’t use the link in the invitation to do your research. Scammers can create convincing websites and email messages that appear to come from legitimate companies. Remember, a website claiming to offer ChatGPT advertising tools doesn’t necessarily have anything to do with OpenAI. If you’re not sure whether an offer is legitimate, ask your marketing agency to check it before you connect your accounts.
2. Use Stronger Google Account Login Protection
If you haven’t already, enable two-factor authentication on your Google account (and every other account you have anywhere else). For even better protection, consider setting up a passkey. A passkey lets you securely sign in using your phone or another trusted device without entering a password into a potentially fraudulent website. Passkeys offer stronger protection against fake login websites because they’re tied to the real website, not just the information displayed on your screen. But here’s an important distinction: Using your fingerprint to unlock your phone doesn’t automatically mean you’ve set up a passkey for your Google account.
3. Make Sure Your Advertising Accounts Are Secure
If you own the business, you should know who has access to your advertising accounts. For Google Ads, you can review this by signing in at ads.google.com, opening the Admin section, and looking for Access and security. You should also check for unfamiliar linked manager accounts. But if you’re like most busy business owners, you probably don’t spend much time digging through advertising account settings. If your advertising is professionally managed, ask your marketing agency to review account access and security for you. They can identify unfamiliar users, check permissions, and help make sure former employees or vendors no longer have unnecessary access. It’s a simple request that could save you a significant headache.
What if You’ve Already Entered Your Password Into One of These Fake Websites?
If you suspect you’ve fallen for one of these scams, don’t wait to see whether something goes wrong. Go directly to the real website for the account involved and change your password. Review recent security activity, remove unfamiliar sessions or connected applications, and check any associated advertising accounts for unauthorized users, campaign changes, or unexpected charges. If your advertising is managed by an agency, contact them immediately so they can help secure the account. If you discover unauthorized charges or account changes, contact the advertising provider and your payment provider as appropriate. The sooner you respond, the better your chances of limiting the damage.
Don’t Let Scammers Hijack Your Advertising Budget
These criminals are borrowing trusted names to trick people into giving away their account information. If somebody offers you a shiny new AI tool that needs access to your Google Ads account, make sure you know who’s asking. Don’t let a scammer turn your advertising budget into their payday.
Google Ads Phishing FAQs
