Azerbaijan's cybersecurity agency warns of phishing scheme impersonating AI brands

Azerbaijan's National Cybersecurity Agency (Milli Kibertəhlükəsizlik Agentliyi, MKA) warned on 13 October 2026 of a phishing campaign that uses the names of popular artificial intelligence services to steal passwords and one-time verification codes, according to Report.az.

What the agency found

• The campaign involves fake advertising portals impersonating AI services "such as ChatGPT, Gemini, Claude, Perplexity, Meta Muse and Manus," the agency said, according to Report.az.
• The fake sites offer to manage ad campaigns, analyse ad spend and connect business accounts, but are designed to capture login credentials and one-time codes, Report.az reported.
• Even multi-factor authentication may not protect an account if a victim enters a one-time code on a fake page, since the data goes straight to the attackers, the agency said, according to Report.az.
• The campaign targets "advertising account administrators, media buyers and employees of advertising agencies," Report.az reported, citing the agency.
• Researchers at the security firm Island described the campaign to The Hacker News, which published the findings on 6 October 2026, reporting "browser-in-the-browser" fake login windows with spoofed address bars resembling accounts.google.com, on domains such as museads.ai, live since 16 September 2026.
• The agency advised connecting AI tools to business accounts "only through official websites and trusted integration channels" and checking the browser's address bar rather than any address shown inside a login window, Report.az reported.

Why it matters

The warning shows Azerbaijani regulators treating AI-brand impersonation as an active threat to advertising and marketing staff, less than two weeks after international researchers published the same infrastructure — a gap of seven days.

What it means for Azerbaijani companies

Azerbaijan's Artificial Intelligence Strategy for 2025–2028, approved by presidential decree and reported by Trend.Az on 19 March 2025, lists "establishing rules for identifying and preventing risks related to the protection of personal data when designing, applying, and using AI systems" among its priority actions — the provision addresses the design and use of AI systems and does not, on its face, cover third-party sites that borrow AI brand names. The agency's advisory is the guidance currently on the public record for companies connecting staff accounts to ChatGPT, Gemini or similar services. Marketing teams and agencies running paid campaigns through third-party AI tools should treat the agency's checklist — verify URLs, avoid unsolicited integration links, never share one-time codes — as the current baseline; the warning as published carries no sector-specific rule or penalty.