Browser-in-browser attacks use fake Meta Muse Ad lure to steal credentials

A fast-moving browser-in-browser phishing campaign is impersonating trusted AI and advertising brands to steal advertising credentials, MFA codes, payment methods, and even linked client accounts, creating direct financial loss and operational risk for marketing and digital teams. For CIOs and technology leaders, the key implication is that attackers can rapidly rebrand a reusable phishing platform, so IT organizations need stronger identity controls, continuous domain/reputation monitoring, and detections that work across Google, Meta, TikTok, and Okta workflows—not just brand-specific defenses.