Fake ChatGPT, Gemini, Claude, and Perplexity Sites Steal Ad Accounts and MFA Codes — Detection and Defense Guide

---
title: AI Brand Lookalike Domain DNS Query
description: Detects DNS queries for typosquatted or impersonation domains mimicking ChatGPT, OpenAI, Gemini, Claude, and Perplexity, consistent with the fake AI portal phishing campaign stealing ad account credentials and MFA codes.
references:
  - https://www.bleepingcomputer.com/news/security/fake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes/
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: dns
detection:
  selection_pattern:
    query|re: '(?i)(chatg[bp]t|chatgpt-|openai[-.]?(login|secure|verify|account)|gemini[-.]?(login|pro|secure|ai[-.]login)|claude[-.]?(login|ai[-.]?login|secure)|perplexity[-.]?(login|ai[-.]?login|pro))'
  filter_legitimate:
    query|endswith:
      - '.openai.com'
      - '.chatgpt.com'
      - '.google.com'
      - '.googleusercontent.com'
      - '.anthropic.com'
      - '.claude.ai'
      - '.perplexity.ai'
  condition: selection_pattern and not filter_legitimate
falsepositives:
  - Legitimate regional CDN or partner domains (review and whitelist per environment)
  - Threat research and brand-monitoring activity from security teams
level: high
---
title: Browser Launched in App Mode to External URL
description: Detects Chrome or Edge launched with the --app flag pointing to an HTTP(S) URL, a technique used by phishing lures to suppress the real address bar and increase the credibility of browser-in-the-browser credential theft windows.
references:
  - https://www.bleepingcomputer.com/news/security/fake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes/
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_cli:
    CommandLine|contains:
      - '--app=http://'
      - '--app=https://'
  condition: all of selection_*
falsepositives:
  - Internal web applications deployed as app-mode shortcuts (inventory and whitelist)
  - Kiosk or digital signage configurations
level: medium
---
title: Web Proxy Request to AI Brand Impersonation URL
description: Detects web proxy requests where the URL contains AI brand keywords combined with authentication-related paths on non-official domains, consistent with credential phishing pages impersonating ChatGPT, Gemini, Claude, or Perplexity login flows.
references:
  - https://www.bleepingcomputer.com/news/security/fake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes/
  - https://attack.mitre.org/techniques/T1557/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: proxy
detection:
  selection_brand:
    url|re: '(?i)(chatgpt|openai|gemini|claude|perplexity)'
  selection_auth:
    url|contains:
      - 'login'
      - 'signin'
      - 'auth'
      - 'verify'
      - 'account'
  filter_official:
    url|contains:
      - 'openai.com'
      - 'chatgpt.com'
      - 'google.com'
      - 'anthropic.com'
      - 'claude.ai'
      - 'perplexity.ai'
  condition: all of selection_* and not filter_official
falsepositives:
  - AI news, review, or tutorial sites containing brand names in URLs (tune with domain allowlist)
level: medium

// Hunt: Connections to AI-brand lookalike domains (fake ChatGPT/Gemini/Claude/Perplexity portals)
// Run over the last 14 days; pivot to DeviceProcessEvents and IdentityLogonEvents for exposed hosts/users
let OfficialDomains = dynamic(["openai.com","chatgpt.com","google.com","googleapis.com","googleusercontent.com","anthropic.com","claude.ai","perplexity.ai"]);
let BrandPattern = @"(?i)(chatgpt|chatgbt|openai|gemini|claude|perplexity)";
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where isnotempty(RemoteUrl)
| where RemoteUrl matches regex BrandPattern
| extend RemoteUrlLower = tolower(RemoteUrl)
| where not(RemoteUrlLower has_any (OfficialDomains))
| where RemoteUrlLower has_any ("login","signin","auth","verify","account","secure","premium","pro")
   or RemoteUrlLower matches regex @"(?i)(chatgbt|gpt[-.]?(login|secure)|openai[-]|gemini[-]|claude[-]|perplexity[-])"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), RemoteIPs=make_set(RemoteIP), URLs=make_set(RemoteUrl)
    by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName
| order by LastSeen desc;
// Secondary hunt: browser processes launched with --app= to suppress the address bar (BitB facilitation)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("chrome.exe","msedge.exe","brave.exe")
| where ProcessCommandLine has_any ("--app=http://","--app=https://")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

-- Artifact: Hunt browser history for AI-brand lookalike phishing sites
-- Targets Chrome and Edge history databases for visits to fake ChatGPT/Gemini/Claude/Perplexity portals
LET history_files = SELECT FullPath
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/History',
  'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/History'
])

LET hits = SELECT * FROM foreach(
  row=history_files,
  query={
    SELECT FullPath AS HistoryDB,
           url AS VisitedURL,
           title AS PageTitle,
           timestamp(epoch=visit_time / 1000000 - 11644473600) AS VisitTimeUTC,
           visit_count AS VisitCount
    FROM sqlite(file=FullPath,
                query="SELECT url, title, visit_time, visit_count FROM urls WHERE lower(url) REGEXP '(chatgbt|chatgpt[-.]|openai[-]|gemini[-.].*(login|pro|secure)|claude[-.].*login|perplexity[-.].*(login|pro))'")
  })

SELECT HistoryDB, VisitedURL, PageTitle, VisitTimeUTC, VisitCount
FROM hits
WHERE NOT VisitedURL =~ '(?i)(openai\.com|chatgpt\.com|google\.com|anthropic\.com|claude\.ai|perplexity\.ai)'
ORDER BY VisitTimeUTC DESC

# Security Arsenal - Fake AI Portal Phishing Triage Script
# Audits DNS cache and browser history for AI-brand lookalike domains
# Run elevated; output feeds credential/session revocation prioritization

$BrandRegex = '(?i)(chatgbt|chatgpt[-.]|openai[-]|gemini[-.].*(login|pro|secure|ai)|claude[-.].*login|perplexity[-.].*(login|pro))'
$OfficialDomains = @('openai.com','chatgpt.com','google.com','googleusercontent.com','anthropic.com','claude.ai','perplexity.ai')
$findings = @()

# --- 1. DNS client cache audit ---
Write-Host "[*] Auditing DNS client cache for AI-brand lookalike domains..." -ForegroundColor Cyan
$dnsEntries = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $dnsEntries) {
    if ($entry.Entry -match $BrandRegex) {
        $isOfficial = $false
        foreach ($dom in $OfficialDomains) { if ($entry.Entry -like "*$dom") { $isOfficial = $true } }
        if (-not $isOfficial) {
            $findings += [PSCustomObject]@{
                Source = 'DNSCache'; Indicator = $entry.Entry
                Detail = "Resolved to $($entry.Data)"; Risk = 'HIGH'
            }
        }
    }
}

# --- 2. Browser history audit (Chrome/Edge, all profiles) ---
Write-Host "[*] Auditing browser history for fake AI portal visits..." -ForegroundColor Cyan
$historyPaths = @(
    "$env:SystemDrive\Users\*\AppData\Local\Google\Chrome\User Data\*\History",
    "$env:SystemDrive\Users\*\AppData\Local\Microsoft\Edge\User Data\*\History"
)
foreach ($pattern in $historyPaths) {
    foreach ($histFile in (Get-ChildItem -Path $pattern -ErrorAction SilentlyContinue)) {
        $tempCopy = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid().ToString() + ".db")
        try {
            Copy-Item $histFile.FullName $tempCopy -Force -ErrorAction Stop
            $raw = [System.IO.File]::ReadAllText($tempCopy, [System.Text.Encoding]::ASCII)
            $matchesFound = [regex]::Matches($raw, 'https?://[^\s\"''<>]+') | ForEach-Object { $_.Value }
            foreach ($url in $matchesFound) {
                if ($url -match $BrandRegex) {
                    $isOfficial = $false
                    foreach ($dom in $OfficialDomains) { if ($url -like "*$dom*") { $isOfficial = $true } }
                    if (-not $isOfficial) {
                        $findings += [PSCustomObject]@{
                            Source = "BrowserHistory ($($histFile.FullName.Split('\')[2]))"
                            Indicator = $url; Detail = $histFile.FullName; Risk = 'CRITICAL'
                        }
                    }
                }
            }
        } catch { Write-Host "[!] Could not read $($histFile.FullName): $_" -ForegroundColor Yellow }
        finally { Remove-Item $tempCopy -Force -ErrorAction SilentlyContinue }
    }
}

# --- 3. Report and next-step guidance ---
if ($findings.Count -gt 0) {
    Write-Host "`n[ALERT] $($findings.Count) indicator(s) of fake AI portal exposure found:`n" -ForegroundColor Red
    $findings | Sort-Object Risk | Format-Table -AutoSize
    $findings | Export-Csv -Path "$env:TEMP\ai_phishing_triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "REQUIRED ACTIONS for flagged users:" -ForegroundColor Yellow
    Write-Host "  1. Immediately revoke all active sessions (Google, Microsoft, Meta, ad platforms)"
    Write-Host "  2. Reset passwords AND re-enroll MFA (assume seed/TOTP compromise)"
    Write-Host "  3. Audit Google Ads / Meta Business Manager for new users, recovery email changes, and unauthorized campaigns"
    Write-Host "  4. Review recent ad spend for fraudulent activity and file platform abuse reports"
} else {
    Write-Host "`n[OK] No AI-brand lookalike indicators found on this host.`n" -ForegroundColor Green
}