Researchers found a phishing kit posing as AI ad tools (Muse, ChatGPT, Gemini) that fakes a Google sign-in window inside your browser to steal passwords and MFA codes. It can fake a lock icon and URL bar, not the real browser's address. So what: use passkeys.
