That Google login window is not a window

Ok, this one I had to read twice.

You find a new AI ad tool. Gemini, Claude, ChatGPT, Meta's new Muse, something like that in the name. Looks professional. You click Connect, a normal Google sign-in window pops up, accounts.google.com in the address bar. You type your password. Then the code from your phone.

That window was never a window. It is a picture drawn inside the web page, and the address bar is part of the picture. It's called browser-in-the-browser.

And the nasty part - there is a real person on the other side watching you type, live. He picks what you see next. SMS code, authenticator app, push approval. He can even reject your code and ask for a new one. MFA done. For him.

Island, the browser security company, wrote the whole campaign up: https://www.island.io/blog/behind-the-connect-button-the-fake-ai-ads-campaign

Who are they after? People who run ad accounts. Makes sense. An ad account has a card and a budget attached, and one agency login can open many clients.

The test is stupid simple. Grab the popup and drag it outside the browser. A real one moves. A fake one stays stuck inside the page. BTW your password manager will NOT fill your password on a fake domain - if it suddenly "doesn't work", that's not a bug, that's your warning.

New AI tool every week. New fake one every week too. Drag first, type later :)