MetaChat Brand Impersonation Phishing Campaign Targets AI API Keys and Credentials via EdgeOne Pages
MetaChat Brand Impersonation Phishing Campaign Targets AI (TL-2026-1522), also tracked as MetaChat Phishing Cluster, is a high-severity phishing campaign, first published 2026-07-19. It has no confirmed attribution, affects MetaChat MetaChat AI Aggregation Platform (brand/users impersonated), maps to 20 MITRE ATT&CK techniques (T1036, T1056, T1087), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-1522
- Threat ID
- TL-2026-1522
- Also known as
- MetaChat Phishing Cluster, EdgeOne MetaChat Impersonation Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-19
- Last reviewed
- 2026-07-19
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, individualconsumers, softwaredevelopment, finance
- Target regions
- Global, Asia-Pacific, china
- Detection rules
- 9
- Indicators of compromise
- 34
PreCrime Labs (BforeAI) uncovered an organized phishing operation impersonating MetaChat, an AI aggregation platform offering 30+ AI models (ChatGPT, Gemini, Claude, Midjourney, Grok, DeepSeek). Roughly 18 lookalike domains hosted on Tencent's free EdgeOne Pages platform harvest credentials, AI API keys/access tokens, payment data (including WeChat Pay), and referral network data via dedicated credential-harvesting endpoints and malvertising.
How MetaChat Brand Impersonation Phishing Campaign Targets AI works
PreCrime Labs, the research division of BforeAI, identified a semi-automated phishing cluster impersonating MetaChat, a legitimate AI aggregation service that provides unified access to more than 30 AI models under one account, including ChatGPT, Gemini, Claude, Nano Banana, Midjourney, Grok, and DeepSeek. Approximately 18 lookalike domains were discovered, all hosted on Tencent's EdgeOne Pages free static-site hosting platform and following a predictable three-part naming convention: metachat-backend-[unique-id].edgeone.app, where [unique-id] is a randomly generated 10-character alphanumeric string. This naming pattern indicates semi-automated or scripted domain registration/provisioning rather than manual, one-off phishing kit deployment, enabling the operators to rapidly rotate infrastructure and outpace naive blocklist-based defenses.
Each phishing site clones the MetaChat login/registration flow and wires a set of purpose-built backend endpoints to harvest distinct categories of victim data: /user-register and /user-login capture account credentials (email, username, password, phone number); /user-api-key and /user-api-info capture AI API keys, access tokens, and account metadata for the platforms MetaChat aggregates; /user-recharge, /orders, and /chat/payment capture payment card and WeChat Pay transaction data tied to fraudulent 'recharge' (top-up) flows; /approval-token-withdraw captures internal session/approval tokens tied to withdrawal authorization; and /user-referees together with a SubAgentRefereeRechargePackage endpoint map the victim's referral network, indicating the operators are also running a two-tier MLM-style referral/commission fraud scheme layered on top of the credential theft.
Monetization is multi-pronged: stolen AI API keys and access tokens (for Claude, ChatGPT/Cursor, and other premium AI subscriptions) are resold on underground/cybercrime forums for unauthorized service consumption; WeChat Pay 'recharge' flows are abused to directly defraud victims of funds; and the referral/MLM structure incentivizes victims (and complicit distributors) to recruit further victims, amplifying reach. Because EdgeOne Pages is a free, low-friction hosting service backed by Tencent's legitimate CDN/edge infrastructure, phishing pages inherit a degree of implicit trust and evade reputation-based blocking that would flag cheaper or newly-registered standalone domains.
A secondary distribution vector uses malvertising via sponsored/paid search placements to route victims to lookalike pages impersonating other AI brands — for example, claude-app-new.gitlab.io impersonating Claude Code — placed above official links to exploit user purchase/download intent. This is consistent with a broader wave of AI-brand malvertising/impersonation activity observed across GitLab Pages and Google Ads in 2026 (a related, larger campaign used 92+ unique malicious GitLab Pages hostnames impersonating Claude Code, ChatGPT Codex, Perplexity, Cursor IDE, and JetBrains, paired with ClickFix-style social engineering to get victims to paste and execute malicious terminal/PowerShell commands). While the GitLab/ClickFix cluster is a distinct, malware-delivery-focused campaign, PreCrime Labs flags it as part of the same overall trend of attackers weaponizing the trust and hype around AI tools to target both credentials and endpoints.
Detection guidance from the source emphasizes flagging any newly registered subdomain on free hosting providers (EdgeOne Pages, GitLab Pages, and similar) that combines a 'backend'-style identifier with AI-specific keywords ('metachat', 'ai', 'api', 'chat', 'gpt', 'key') or financial-fraud keywords ('recharge', 'wallet', 'login'), particularly when the domain is registered/provisioned 30-60 days before becoming active in phishing distribution — a pattern PreCrime Labs' predictive models used to identify the cluster before full-scale abuse.
MITRE ATT&CK techniques used in TL-2026-1522
Defense Evasion
Credential Access
T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie
Discovery
Command and Control
T1090 Proxy; T1102 Web Service
command-and-control
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Execution
Impact
T1531 Account Access Removal; T1657 Financial Theft
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities
Affected products and versions in MetaChat Brand Impersonation Phishing Campaign Targets AI
- MetaChat — MetaChat AI Aggregation Platform (brand/users impersonated)
Vulnerable versions: N/A - brand impersonation, not a software vulnerability - Tencent — EdgeOne Pages (abused as free hosting infrastructure)
Vulnerable versions: N/A - platform abuse, not a software vulnerability - Anthropic — Claude / Claude Code (secondarily impersonated via related malvertising)
Vulnerable versions: N/A - brand impersonation - GitLab — GitLab Pages (abused as hosting infrastructure for related Claude Code impersonation)
Vulnerable versions: N/A - platform abuse
Remediation for MetaChat Brand Impersonation Phishing Campaign Targets AI
Immediate actions
- Block/flag domains matching the pattern metachat-backend-*.edgeone.app at web/email gateways and DNS resolvers
- Block or heavily scrutinize the identified claude-app-new.gitlab.io and related lookalike malvertising domains
- Force rotation of any AI API keys/access tokens (Claude, ChatGPT, Gemini, Midjourney, etc.) that may have been entered into a MetaChat-impersonating site
- Alert users who use MetaChat or AI-aggregation platforms about the specific phishing pattern and endpoint URLs
- Report identified phishing hostnames to Tencent EdgeOne abuse team and to GitLab abuse team for takedown
Workarounds
- Bookmark and only use the official MetaChat domain directly rather than following search or ad links
- Use hardware-backed or short-lived API keys where the aggregation platform supports it, limiting blast radius of key theft
- Enable MFA on AI platform accounts where supported to reduce impact of credential harvesting
Longer-term hardening
- Deploy predictive domain-monitoring that flags new subdomains on free hosting platforms (EdgeOne Pages, GitLab Pages, Netlify, Vercel, etc.) combining AI-brand keywords with 'backend'/'api'/'key' identifiers
- Implement brand-protection monitoring for MetaChat, Claude, ChatGPT, and other AI-platform trademarks across ad networks and free hosting providers
- Educate users never to enter AI API keys or payment credentials on any site reached via a sponsored/paid search ad rather than a bookmarked or manually-typed official URL
- Work with ad-network providers (Google Ads) to strengthen brand-impersonation detection for AI-tool sponsored listings
- Monitor underground/cybercrime forums for resale listings of stolen AI subscription credentials tied to this cluster
Weaknesses (CWE) in MetaChat Brand Impersonation Phishing Campaign Targets AI
CWE-1021, CWE-451, CWE-290
Timeline of MetaChat Brand Impersonation Phishing Campaign Targets AI
- Estimated earliest domain registration/provisioning window for the metachat-backend-*.edgeone.app cluster, based on PreCrime Labs' 30-60 day pre-activation observation window ahead of the April 21 flash notice.
- First wave of a related AI-brand malvertising campaign launches, using claude-code-app.gitlab.io as primary lure supported by claudeapp.gitlab.io, part of the broader AI-tool impersonation trend PreCrime Labs references.
- CSO Online reports on attackers abusing Google Ads, GitLab, and Claude branding to deliver malware via ClickFix-style social engineering, a parallel/related AI-impersonation vector.
- Straiker publishes research on the ACR Stealer / fake Claude Code impersonation campaign targeting AI developers.
- Graphika publishes 'Malicious Commands: Fake Claude Code & ChatGPT Installers' documenting 92+ malicious GitLab Pages hostnames impersonating multiple AI brands.
- PreCrime Labs (BforeAI) publishes flash notice identifying the ~18-domain MetaChat impersonation cluster hosted on EdgeOne Pages, detailing the credential-harvesting endpoints and payment/referral fraud mechanics.
- Cyble publishes analysis of the broader AI-assisted phishing campaign trend harvesting victim data, contextualizing the MetaChat cluster within a wider 2026 AI-brand phishing surge.
- SC Media reports on AI-powered phishing campaigns leveraging browser hardware-permission abuse for data theft, part of the same threat landscape.
- Kaspersky publishes findings on a distinct but related corporate phishing technique abusing EdgeOne Pages / AI web-development platforms, documenting over 8,000 phishing emails in a 30-day period across English, Korean, and Russian targeting industrial, sales, and government sectors — corroborating EdgeOne Pages as an actively abused phishing hosting platform beyond the MetaChat cluster.
- IT Security Guru reports AI-powered phishing attacks surged 1,380% year-over-year, citing criminal AI platforms rendering traditional MFA-based defenses less effective — situating the MetaChat cluster within this broader growth trend.
- Threat added to the Threadlinqs Intelligence pipeline (HUNT phase) and researched (this RESEARCH phase) based on the BforeAI flash notice and corroborating open-source reporting.
Sources cited for MetaChat Brand Impersonation Phishing Campaign Targets AI
- Scam Alert: MetaChat Impersonations Targeting AI API Keys
- EdgeOne Resource Abuse Prevention
- Kaspersky has discovered a new corporate phishing technique using a popular AI web development platform
- Kaspersky Flags AI Platform Abuse in Phishing Surge
- Attackers abuse Google Ads, GitLab, and Claude to deliver malware
- Fake Claude Code, Real Malware: Inside the Campaign Targeting AI Developers
- Malicious Commands: Fake Claude Code & ChatGPT Installers
- Malware campaign impersonating Claude Code install via Google Ads
- AI-Assisted Phishing Campaign Harvesting Victim Data
- AI-powered phishing campaign leverages browser permissions for data theft
Threats related to MetaChat Brand Impersonation Phishing Campaign Targets AI
Detection coverage for TL-2026-1522
As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1522 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.