SecurityHeroblog
Security Basics4views

A 'Google Teller Counter' Set Up Inside a Strip Mall — A Login Window with the Address Bar Painted In

You clicked 'Sign in with Google' and a window appeared whose address was genuinely Google's. But that window was a fake the phishing page had drawn inside its own screen. Behind it, a human operator was taking the password and the verification code in real time. Based on a report from the security firm Island, here is the one place that separates a real window from a fake one.

Picture a neighborhood shop building. The first floor is a snack bar, the second a cram school, the third a dental clinic. A large sign reading ‘OO Mall’ hangs over the building entrance.

But at the end of the second-floor hallway, a bank teller counter has been set up. There is a blue sign, and a ticket dispenser too. A uniformed employee is sitting there. The sign carries the name of a bank everyone knows. The employee smiles and slides a sheet of paper across. “Please write your account password here.”

Anyone can hang a sign. But you cannot change the building’s address. Whatever the counter’s sign says, the place you are standing in is still ‘OO Mall, 2nd floor’.

Today’s story is about how this ‘fake counter inside a shopping building’ shows up on the internet. I will stay inside this building for the rest of the post.

What Happens — A Login Window Whose Address Is Genuinely Real

FACT The security firm Island published a report on October 6. It concerns a single phishing platform. Phishing refers to fraud that collects passwords through a fake screen dressed up to look real. This platform posed as the ‘ad management tools’ of AI services like ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus.

FACT The scene goes like this. You land on a page like ‘AI Ad Optimization Beta’. You click the ‘Connect’ button. A Google login window appears. In the address field at the top of that window, accounts.google.com is displayed. That is Google’s real login address. You enter your password, then enter the verification code that arrived by text message. A ‘Please wait a moment’ screen appears. While you wait, the operator is logging into your real account with the values they just received.

FACT That login window was not opened by the browser. A browser is the program you use to view the internet, like Chrome or Safari. The window in question is a picture the phishing page drew inside its own screen. This technique is called ‘browser-in-the-browser’ (BitB). It means drawing one more browser-shaped picture inside a browser. The whole time, the real browser stays on the phishing site.

INFERRED Moved back into the building, it goes like this. The address you see inside the popup is the sign hanging over the counter. It says Google. The address bar at the very top of the browser is the building’s address. That spot still shows the phishing site’s address.

FACT This counter even changes its interior decoration to match the customer. It imitated a separate look for Windows, Mac, iPhone, and Android. It copied the way iPhone Safari displays an address. It also copied the look of the login screen Chrome shows inside an app. It even matched dark mode (the setting that makes the screen dark).

FACT And Google is not the only sign. Meta’s and TikTok’s login screens were forged too. There was an Okta login screen as well. Okta is a service companies use for employees logging into work accounts.

Not Only Ad Managers Were Targeted

FACT Fake recruitment pages also ran on the same platform. They impersonated brands like Tesla, Adidas, Louis Vuitton, and Nike. To apply, they tell you to log in with your company account. It is bait aimed at applicants’ workplace accounts.

FACT So the people who could fall for this technique come out like this. Marketers who manage Google, Meta, and TikTok ad accounts; ad agency staff; self-employed people who run their own ads. And office workers who see a well-known brand’s job posting and try to log in with their company account.

INFERRED Read the headlines alone and it sounds like a story about marketers. But almost anyone presses the ‘Sign in with Google’ button several times a day. Two things should be kept separate, though. The people targeted right now (ad managers and job applicants) and the range of people this technique could work on are different stories. There is no basis in the report that Korean users were targeted.

Why It Works — There Is a Person Sitting Behind the Counter

When we hear “fake screen,” it is easy to picture an automated program running on its own. This case is different.

FACT A human operator watches the input in real time. Even when you enter the correct password, they may deliberately say it was ‘wrong’ and make you enter it again. They also pick what to ask for next on the spot. It could be a text-message verification code, or a code shown in an authenticator app, or a ‘approve this login’ notification popping up on your phone.

This is where two-factor authentication comes in. Two-factor authentication is a step that checks one more time, with something like your phone, after the password. It exists to protect the account even if the password leaks.

INFERRED But when the counter employee is a human, this safeguard loses its power. Drawn back into the building, it goes like this. The employee writes down your password. That slip goes out the back door and into the hands of a colleague standing in the real bank. The colleague calls and says, “They’re asking for a verification code.” The employee says to the customer, “A number came to your phone, right? Read it out to me.” A verification code is a number used once and thrown away, so stealing it is useless later. But if it is used right there, the moment it arrives, the story changes.

FACT It was reported that the answer ‘wrong password’ can come back three times even when the password was entered correctly. This number comes not from the Island report but from a BleepingComputer article.

INFERRED One usable signal comes out of this. If you enter a password you know is correct and get rejected, it may not be your fingers slipping. It may be that the counter employee wants to write it down one more time. A correctly typed password being rejected is itself enough reason to stop.

FACT The counter also hangs new signs quickly. 8 days after Meta launched Muse, a fake ‘Muse Ads’ page was added to this platform. It took less than two weeks. It means that when a new service comes out, it is used as bait right away.

The Scale in Numbers

Let’s look at the table first. Please read the last column along with the rest. Numbers confirmed in the primary report are mixed in with numbers that appear only in news articles.

Number What Source
8 days From Meta Muse’s launch until the fake Muse Ads page was added Island report (confirmed)
3 times How many times ‘wrong’ can come back even with the correct password BleepingComputer (reported only)
25 Number of domains tracked (May 27–June 20) Island report (confirmed)
73 Number of servers tracked in the same period Island report (confirmed)

A domain is the name part of an internet address. In building terms, it is the building’s address. A server is the computer that actually runs the site. That would be the office behind the counter.

INFERRED The tracking period runs from May 27 to June 20, roughly 25 days. 25 addresses were caught in that span, so on average that works out to about one address a day. 73 servers works out to nearly three a day. It amounts to one counter being torn out and a new one opening in the building next door the following day. So the approach of memorizing “this address is dangerous” and avoiding it doesn’t fit well here. A habit of telling them apart lasts longer than memorizing addresses.

FACT What the stolen ad accounts are used for was also reported. The leftover ad budget in the account is spent on fraudulent ads, or the account is resold to other criminals. This part, too, appears only in the BleepingComputer article.

So, What to Do Now

There are two things to do. Both can be done today.

One. Look at the building’s address, not the counter’s sign.

FACT A web page can draw an address bar, a padlock icon, and a tab shape. But it cannot change the address at the very top of the real browser. This is the test the Island report pointed to.

So don’t trust the address you see inside the popup. Raise your eyes to the address bar at the very top of the browser. If the address of the unfamiliar page you just arrived on is still sitting there, that login window is a picture. It’s the same as checking the sign at the building entrance rather than the sign over the counter.

If a ‘Sign in with Google’ window appears on a site you’re seeing for the first time, don’t enter your password — just close it. Then open a new tab and type that service’s address in yourself. Real bank business can be handled by going to the real bank building.

INFERRED One check you can use on a PC was also reported. Unlike a real popup, the fake window cannot be dragged outside the browser, and cannot be resized. It’s like a counter nailed to the floor of the building that you can’t carry out. But this appears only in the BleepingComputer article and was not confirmed in Island’s original text. And on a phone you can’t try dragging the window at all. On a phone, only looking at the address at the top is left.

Two. Register a passkey on your Google and Meta accounts.

FACT A passkey is a way of logging in with a key stored on your device instead of a password. This key only works on the real site’s address. The researchers recommended passkeys and authentication done with a physical device (hardware-based authentication) as the strongest defense against this technique.

INFERRED Moved into the building, it goes like this. A passkey is a key that only fits the door of the real bank building. However convincing the fake counter is, this key won’t turn there. So even if you slip and enter your password into a fake window, handing over the whole account becomes far harder.

What We Don’t Know

This blog writes down what it doesn’t know as not known. Here is what has not yet been confirmed in this case.

  • We don’t know how people arrive in the first place. Nothing has been established beyond the fact that invitation emails were used. We do not conclude that it spread through search ads or text messages.
  • We don’t know whether Korea was targeted. The report does not say whether there was a Korean-language page or whether Korean users were targeted.
  • We don’t know how many people were actually hit. There is a line saying input was ‘submitted hundreds of times’. But whether that is the number of successful account takeovers is unknown. The articles also stated it is not a count of successes. So this post does not use that number as a victim count.
  • We don’t know who operates it. The nationality or affiliation of the attackers has not been established. We do not infer it either.
  • The ‘can’t be dragged out’ check is only half a check. It can only be used on a PC. And this method is not written directly in the primary report. On a phone, only looking at the browser’s real address display is left.

There are three places in this post where we wrote ‘it was reported’. The password being rejected three times, the window not being draggable, and the way stolen ad accounts are used. All three came from news articles, not from Island’s original text.

Sources

Primary sources first.

We opened Island’s original text directly and confirmed the list of impersonated services, the structure of the fake window, the operator’s real-time relaying, the recruitment bait, the domain and server counts, and the passkey recommendation. Then we cross-checked it against the news articles.

This post was written from the brief as of 2026-10-08. The material is published reports and news coverage, not our own honeypot observations. That is why there are no attack timeline, MITRE, or IOC blocks, and no masked IPs or credential quotes. We don’t have that material for this one. The accounts.google.com that appears in the body is Google’s real login address. We wrote it to explain what the fake window imitated, and we did not include the phishing site addresses. We used only the figures that are in the brief. Comparisons like ‘about one a day’ are values we divided out ourselves from those figures, so they are marked as inferred. Not confirmed: the entry path, whether Korean users were targeted, the actual number of successful takeovers, the attackers, and a primary source for the ‘the fake window can’t be dragged out’ check. We do not include commands, addresses, or procedures that could be copied. Published 2026-10-08.