AI Weekly Malaysia

Researchers at Island disclosed a human-operated phishing platform that impersonates ad products for ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus, using a browser-in-the-browser (BitB) fake window whose address bar shows legitimate origins like accounts.google.com or an Okta tenant. One site, museads.ai, appeared on September 16, 2026 — about a week after Meta launched Muse — and its "Connect" button fingerprints the device, logs every password attempt, and lets the operator choose which MFA challenge the victim sees; stolen credentials are used to sign in in real time, with data sent to /api/send/ip over Socket.IO. Each brand gets a tailored pitch (ChatGPT promising a Monday Google Ads brief, Gemini promising manager-account and linked-client support), targeting Google, Meta, TikTok, and Okta workflows.

Why: If anyone on your team connects ad accounts or SSO through a link from a sales pitch or DM, the usual 'check the URL' defence fails here because the address bar is drawn inside the page. Concretely: stop approving Okta or Google sign-ins you did not start yourself, since the operator picks which MFA prompt you see, and treat any 'connect your ad account' tool pitched under an AI brand name as unverified unless you reached the real console by bookmark or typed URL. Watch Okta/Google sign-in logs for MFA challenges no one initiated.

Anthropic announced an expansion of its Claude for Startups program at SF Tech Week. Qualifying companies get a free year of Claude Team with up to five premium seats, $1,000 in API credits, access to Claude Marketplace for building plug-ins, and virtual office hours with Anthropic's Applied AI team. Eligibility requires being founded in the last five years or receiving funding in the last two years, with applications through the Claude for Startups program page.

Why: Eligible startup founders should check the two specific eligibility windows—founded within five years or funded within two years—and decide whether five free Claude Team seats plus $1,000 in API credits meaningfully offset their AI tooling budget. If you do not qualify or Claude is not in your stack, the text has no Malaysia- or SEA-specific detail that changes the decision.