Fake AI Ad Portals Are Stealing Logins: CyberAware UK Mid-Week Intel
This Wednesday's roundup has two stories that could land on any British family's laptop, and one that probably won't.
The big one is fake advertising portals for AI tools. Scammers are buying adverts that look like they lead to ChatGPT, Gemini or Claude, then sending you to a page that copies the real login screen almost perfectly. You type in your email and password, it asks for the six-digit code from your phone, and the criminals take both and sign in as you.
Why bother? Because your chat history is valuable. It might hold work documents, personal details, or passwords you pasted in while asking for help. Your account can also be used to send dodgy links to your friends and colleagues.
The fix is simple. Never log in to an AI tool through an advert. Type the address yourself or use a bookmark you made earlier. And if a login page asks for your one-time code when you weren't expecting it, close the tab.
Second, LibreOffice and OpenOffice have a flaw where a malicious spreadsheet can run code without ever showing a macro warning. No prompt, no obvious sign. This mainly affects people who open files from outside their organisation. If you use LibreOffice at home, make sure it's updated. If a spreadsheet arrives that you weren't expecting, don't open it.
Third, Linux backdoors disguised as email security tools have been spotted in Korea and Taiwan. This is a targeted campaign against specific organisations, so the average household isn't the target. It's worth knowing about, not worrying about.
On the DarkWatch side, a new ransomware-as-a-service operation has started advertising, and a DragonForce leak site is active. These crews recruit and trade, but your defence stays the same: offline backups, updates switched on, and never paying a ransom demand out of the blue.
Your takeaway for today: if a login page arrives via an advert, or a spreadsheet arrives unexpectedly, treat it as suspect. Go direct to the site yourself, and if you didn't ask for the file, don't open it.
Related reading