Browser-in-browser attacks use fake Meta Muse Ads to steal credentials

A recent phishing campaign has begun using a fake product named Muse Ads, which simulates being part of Meta's services, to deceive advertising managers and steal their credentials. This move occurred just eight days after Meta announced its personal AI agent, Muse, on September 8. The website museads.ai, which promises to help advertisers reach buyers, was rapidly launched and presented as a legitimate offer.

Why it matters

This type of attack highlights how quickly cybercriminals can adapt to current events and launch effective phishing campaigns. The use of well-known brands like Meta to lure victims is a strategy that can be very convincing, especially for those working in advertising and technology.

What we know

The operators of this attack have shown that they can modify their existing platform to create a new deception in a matter of minutes. According to Oleg Zaytsev, a security researcher, this speed of adaptation is alarming and poses a significant risk to users who can be easily misled by a facade of legitimacy.

What remains unclear

It has not yet been confirmed how many individuals have fallen victim to this new phishing tactic or what measures Meta is taking to counter these fraudulent attempts. The lack of information regarding the effectiveness of this campaign could be crucial for understanding the scope of the problem.