AI is making fake login pages harder to spot, and they can beat codes

Fake login pages have been around for years, but generative AI is making them cheaper to build and harder to spot. Attackers can now copy a familiar sign-in screen, borrow a trusted brand, and aim a message at a specific employee or company. Some of these pages can also get past the extra security step many people rely on.

What changed

The tricks are not new. What is new is speed and polish. According to the article, AI lets attackers create, customize and adapt phishing campaigns faster and at larger scale. Phishing means tricking you into handing over information. Verizon's 2026 Data Breach Investigations Report found that phishing made up 44% of the AI-assisted break-in methods it examined.

A fake page can copy company logos, page layouts and login prompts. One example in the material is a personalized IT notice that sends an employee to a fake page using the company's own branding. The web address often gives it away, but only if you look closely. Attackers use lookalike addresses with small spelling changes or extra characters.

Why codes do not always help

Many people assume a one-time code makes an account safe. It helps, but these pages can work around it. Some fake pages can collect:

• Your password.
• Your one-time code, which attackers may try to use before it expires.
• Your active session, the signed-in state your browser keeps after you log in.

The session is the sneakiest. If attackers steal it, they can get into the account without a password or another code. That is how a convincing fake page can unlock work or personal accounts even with extra security turned on.

Who it affects

The article focuses on employees and businesses that depend on online work accounts. But the tactics reach anyone. Fake links do not only come by email. They also arrive by text message, workplace chat tools and search ads. That matters because email filters, blocklists and reputation services can stop many known threats, yet brand-new or short-lived fake sites may slip past them.

Training helps, but the material is blunt that even experienced users can miss subtle warning signs when a page looks familiar. A padlock or HTTPS in the address bar does not prove a site is real.

What to do

The steps in the alert box above cover the basics. The main idea is to stop treating a link in a message as a safe way to reach a login screen. If a notice about your account or IT feels odd, check it with your IT team before acting.

What is not known

The material does not say how many attacks have happened or which brands are being copied. It also comes from Keeper Security, a company that sells AI-based phishing protection, so the article points to that kind of tool as one fix. The warning itself matches what the Verizon figure and the described attack methods show.