AI phishing aimed at dealership ad accounts uses fake AI advertising tools that pose as brands like ChatGPT, Gemini, or Meta’s Muse. Their Connect button opens a counterfeit sign-in window, and a live operator walks the victim through handing over the account.
Last updated: October 23, 2026
Ask your marketing director who has admin rights on the store’s Google Ads and Meta ad accounts. Then ask your agency the same question. Compare notes. I’d bet the two answers don’t match, and I’d bet nobody has the whole list written down anywhere.
That’s a real problem. Those logins just became a target. In October 2026, researchers at Island published Behind the Connect Button: The Fake AI Ads Campaign, a look inside a phishing operation dressed up as a lineup of AI advertising products. The fake tools borrow the names of ChatGPT, Gemini, Claude, Perplexity, and Manus. Eight days after Meta launched Muse, the operators added a fake “Muse Ads,” too.
The bait is written for the people who run paid media: agency staff, media buyers, and the administrators of manager accounts. At a dealership, that’s your marketing director, maybe your BDC director, and whoever at your agency runs the store’s campaigns, which means the people holding the keys to a budget the Dealer Principal signs off on every month are the ones getting these emails. Not exactly the people anyone pictures when they think about cyberattacks. They should be.
We support 2,000-plus dealerships, and phishing is still a big thing. It just keeps changing costumes. This one is about ad account phishing: how the lure works, why criminals want an ad account at all, and what I’d lock down first. It’s one piece of the cybersecurity work we do for dealerships, and it starts with a plain question.
Who owns that?
Who at Your Store Holds the Ad Account Keys
A former agency with manager access still linked to your Google Ads account is the first thing I’d look for. Nothing breaks when that access stays. So nobody removes it. The same goes for the marketing manager who left two years ago and still shows up as an admin on the Meta business account, even though nobody at the store could tell you the last time that person signed in or whether the password ever changed.
Here’s who usually holds some piece of the store’s ad accounts, and what a stolen login would hand over:
| Who | What they can usually do | What a phished login hands over |
|---|---|---|
| Marketing director | Admin on Google Ads and the Meta business account | Adding users, changing billing, approving spend |
| BDC or digital sales manager | Runs lead campaigns, sometimes through a personal Facebook profile | The store’s page and its lead forms |
| Agency account manager | Manager account access across many dealer clients | Every store that agency runs, not just yours |
| GM or Dealer Principal | Owner of the billing profile, rarely signs in | Recovery email and phone, if they point to this person |
| Former employees and past agencies | Whatever access nobody took away | A login nobody is watching |
An ad login is a company credential. Treat it like one. Check yours today.
How the Fake Connect Button Works
The window isn’t real. It’s a picture of one. Click Connect on one of these fake AI tools and you never actually leave for Google or Meta. Island found the page “draws a fake Google window inside itself,” address bar and all, with accounts.google.com sitting right there where you’d look for it, while your real browser hasn’t gone anywhere. The industry name for this is browser-in-the-browser. This crew went further and copied little Safari and Chrome details, so it passes on an iPhone and on the desktop in the sales office.
Island’s report lays out how a typical run goes:
- Somebody gets an invite email for a slick AI ad product. Maybe it’s a “Monday Google Ads brief” with ChatGPT’s name on it, or a Perplexity-branded campaign planner.
- The page wants the ad account connected. Nothing about that feels strange, because every legitimate integration your marketing team ever set up asked for the same thing.
- Connect pops up the counterfeit sign-in. Google, Meta, and TikTok versions all exist.
- Your employee types a password. From there it’s a person on the other end, not a script, who can claim the password was wrong, park your employee on a “please wait” screen, and choose whether the next prompt asks for a text code, an authenticator code, or a push approval.
- Every answer goes to that operator. They can be using it on the real account while your employee is still looking at the fake one.
That fourth step is what gets me. I’ve seen plenty of fake login pages over the years, and the old ones were dumb: grab a password and hope it still works later. With this one, actual people sit on the other end in real time and ask for whatever code the real login happens to want right then. Island counted “hundreds of victim submissions,” and the campaign hadn’t stopped when they published. This is organized.
The same setup also runs fake refund pages and fake recruiting pages, so the AI branding is just this season’s costume. If you want the basics of how any phishing attack gets built, our walk-through of the anatomy of a phishing attack covers it. Back in 2023 we wrote about AI making social engineering more convincing. This is a newer version of that problem, with a Connect button on it.
If the page drew the address bar, the address bar is lying.
Why Criminals Want an Ad Account
Island puts it in one line: “an advertising account is a spending account.” It comes with a stored payment method, a budget somebody already approved, and a spending history that a criminal can’t build on their own overnight. Citing outside research, the report says attackers either burn that budget on their own campaigns or sell the account, and aged accounts with a clean spending history sell on Telegram for 2 to 4 times the price of new ones.
Think about your store’s Google Ads account in those terms. Years of history. A card or an invoicing line on file. A monthly number the Dealer Principal signed off on. To a criminal, that’s inventory.
Agencies make it bigger. A manager account can reach several client accounts, each with its own billing and its own users, and Island is blunt about it: “the damage reaches the agency’s clients.” Your people didn’t click anything. Doesn’t matter. You still have the problem.
Then comes the part dealers don’t expect. Island notes that victims can usually pull the card within hours. Good. The account is a different story, because attackers “typically add their own administrators and downgrade the legitimate owner,” and recovery “can take weeks or months while the account keeps serving ads.” That’s weeks of somebody else’s ads running under your store’s name, on your page, in your customers’ feeds, while you wait on a support queue. If your store spends a few thousand dollars a month on search and social, the money lost before anybody notices is annoying, but the weeks spent proving to Google or Meta that you’re the real owner are what actually hurt.
It spreads, too. If the store’s Google Ads login is the same Google account somebody uses for email and shared files, one stolen password opens all of it. And if your store’s Facebook and Instagram pages are the bigger worry, our guide to Instagram phishing covers the same takeover pattern on the social side, including what to do when a page you’ve run for years suddenly isn’t yours.
Canceling the card takes an afternoon. Getting the account back doesn’t.
What I’d Lock Down First
To be clear, I’m not the guy telling you to stay away from AI advertising tools. I use AI constantly myself. Some of them are useful, and your marketing team is going to try them either way. The argument isn’t whether to use them. It’s how they get connected, and whether anybody’s watching when they do.
- Phishing-resistant sign-in for anyone with admin or manager rights. Text codes and push approvals beat nothing, but they’re exactly what a live operator knows how to ask for. CISA’s fact sheet on phishing-resistant MFA calls FIDO and WebAuthn methods, which include passkeys and hardware security keys, “the gold standard,” and it urges high-value targets to move to them. Your ad admins are high-value targets now. Start there.
- Connect AI and ad tools only from the vendor’s own site. An email inviting you into a beta? Go to the vendor’s real website yourself and find it there, or don’t connect it. Simple rule. Island’s advice is to treat any new AI integration as what it really is, a request for access to your account.
- Read the browser’s own address bar, the outermost one. A page can draw a lock icon. It can’t change where your browser actually is.
- After any suspicious click, the same day, check who the admins and managers are, whether the recovery email or phone changed, and whether any campaign or spend showed up that nobody approved. Don’t wait a week. Google’s steps for a compromised Google Ads account start with recovering the Google account itself and then reporting it.
- Clean up the list from the table. Former employees and old agencies come off, and at least two people at the store, not only the agency, should hold admin rights. Two, minimum. If everyone with admin rights works at the agency, then your store’s ability to get its own account back depends entirely on how fast somebody else answers the phone.
Training Built for the People Who Get These Emails
All of that helps. Phishing works on people, though. The lure still lands in a person’s inbox, and that person decides whether to click. Helion’s compliance offering includes security awareness training customized for dealership employees, so the examples look like what actually shows up at a store: the controller, the BDC, the marketing director holding the ad logins. It comes with a team that makes sure the training gets done. That’s on us to get it all done, and make sure it’s right.
The getting-done part matters more than people think. Finishing is the point. The FTC Safeguards Rule calls for security awareness training “updated as necessary to reflect risks identified by the risk assessment” (16 CFR 314.4(e)), and a new lure aimed at your marketing team is exactly that kind of risk. Emailing a video link once a year and hoping people watch it isn’t training. Nobody does compliance that way. Our piece on employee cybersecurity awareness training has more on why it belongs in the program at all.
Questions Dealers Ask About AI Phishing
Our agency runs our ads. Isn’t this their problem?
We already use two-factor on the ad accounts. Doesn’t that cover us?
Somebody on our team already clicked Connect. What do we do, in order?
How do you tell a real AI ad tool from a fake one?
Where does the FTC Safeguards Rule fit in?
The Account Is the Prize
Dealers think of the ad budget as a marketing line. Criminals don’t. They see a stored card, a spending limit, and a login, and the login is the part they really want. If you’d like a second set of eyes on who holds those logins, how they sign in, and who would notice if one of them changed tonight, start with our complimentary IT and cybersecurity assessment.
Protect the login. The card was never the hard part.