Will fake AI chatbot phishing sites steal MFA codes from 100+ users by Dec 2026?

A new campaign mimics ChatGPT, Gemini, Claude, and Perplexity websites to harvest login credentials and multi-factor authentication (MFA) codes using browser-in-browser attacks (Bleeping Computer). This is a novel social-engineering vector exploiting trust in AI platforms.

Resolution Criteria

Confirmed by security vendor threat reports, CISA alerts, or news coverage citing verified account compromises or MFA token theft linked to these fake sites. 100+ documented victims required to resolve YES.