“Connect" Attacks: The Risks of Unvetted AI Tools

We’re back, and we have been busy behind the scenes at TCF.

Here’s the latest:

• We’ve started doing in-person speaking engagements and having more of a presence at family office events. Our team is out and about speaking with family office leaders, hearing their concerns, and learning how best to serve the community. Please visit our Events page to see where you can hear us speak and chat with us live.

• Coming up on October 29 in San Francisco, TCF will be speaking on “How AI Is Rewriting the Rules of Family Office & Wealth Management Security Culture,” an event hosted by Robert Half. RSVP for the event here.

• Our Family Office AI Adoption and Cybersecurity survey is live, and if you haven’t taken it, we’d love to hear from you. Go here to participate and be the first to receive the report on our findings.

• We’re launching a podcast! We know there is plenty of competition for the time you set aside for podcasts, and The TCF Pod aims to be on your list. We’ll be sharing insights from our work and hosts guests from the family office world with the goal of educating family offices about information risk and cybersecurity. Expect our first episode in the next few weeks.

Hope to see you in person soon. Until then, we hope you find valuable insights in this briefing.

Family office teams are putting their trust in unvetted AI tools. Attackers are posing as AI tools and drawing fake address bars and lock icons on a web page, leaving the user open to infiltration.

It’s an ordinary Tuesday inside a family office. The principal’s executive assistant hears about a new AI scheduling assistant and clicks “Connect” to link their work calendar. The family office controller tries an AI research tool recommended by a peer. A next-generation family member signs in to a promising new AI app with the family's Google account. Each of these moments ends with the same screen: a sign-in window and a request for a password and a code.

Island, a browser security firm, documented a phishing campaign that turns that moment into an attack. In that campaign, the attackers posed as a portfolio of AI advertising tools carrying the branding of Gemini, Claude, ChatGPT, Perplexity, and Manus, and invited visitors to click “Connect.” Island reports hundreds of victim submissions, with activity still ongoing at the time of writing. The campaign aimed at advertising teams and agencies. The technique applies to anyone who signs in to anything, which describes every family office. This is happening now, and here is how it works.

The fake window. Clicking “Connect” opens a complete browser window drawn inside the real one, with a lock icon and an address bar showing accounts.google.com or the company's own Okta/other single sign-on (SSO) address. The real browser stays on the attacker's domain the whole time. This technique is called browser-in-the-browser (a counterfeit login window rendered as part of a web page). The fake adapts to Windows, macOS, iOS, and Android, and copies details such as Safari's address pill. The habit most family office staff have learned, checking the address bar, shows them exactly what they expect to see.

The human operator. Behind the page, a person watches submissions arrive in real time and decides what the victim sees next. The operator can reject a password, hold the victim on a waiting screen, and choose which multi-factor authentication (MFA, the second proof of identity, such as a text code or an approval tap) challenge appears. A one-time code or an approval tap offers little protection when someone on the other end requests it at the moment of their choosing.

The speed. The campaign added a fake Muse Ads lure eight days after Meta introduced its Muse AI agent. KnowBe4 reports that attackers now convert headlines into campaigns 5.4 times faster than they did four years ago. Every AI launch the family office team reads about becomes a candidate lure within days.

The aftermath. Once inside, attackers typically add their own administrators and demote the legitimate owner. Recovering the account can take weeks or months. Manager accounts reach multiple client accounts, so one login spreads to everything behind it.

What This Means for Your Family Office

AI adoption is the opening. Family office teams are trying AI tools for email, documents, research, and reporting, and every tool asks to connect to something. A request that raised eyebrows two years ago now reads as onboarding. TCF’s Family Office AI Adoption and Cybersecurity survey measures how offices handle exactly this, because the approval path for a new AI tool has become a core control.

Your family office is a manager account. Island found that a single compromised advertising manager login exposes every client account behind it. A family office login carries the same property. One staff identity can reach the principal’s inbox, the trust and entity documents, the shared drive for every family branch, and the custodian and banking portals behind single sign-on (one login that unlocks many systems). One stolen login reaches the family’s financial and personal information.

The attacker's next move has a family office version. In the campaign, the attacker adds administrators and demotes the owner. Inside a stolen family office mailbox, the equivalent moves are a forwarding rule, a delegate added quietly to the principal’s account, or a changed recovery phone number. These changes sit unnoticed until a wire instruction arrives in a familiar voice from a familiar address.

The next generation brings its own accounts. Younger family members try new AI products early and often, sometimes with a family or shared sign-in. Their curiosity is an asset, and a short briefing on this technique turns it into a second line of defense for the whole family.

Text codes and approval taps reach their limit here. Standard MFA stops the bulk attacks that run on automation. A live operator steering the prompt changes the math. Island recommends phishing-resistant authentication, such as passkeys and hardware security keys, which bind the login to the real website's address. A fake window cannot fool a key that checks the true domain.

Operating businesses and family brands sit closest to the original target. A portfolio company or family brand with an active ad account, a stored payment method, and a marketing team trying new AI tools matches the campaign's profile exactly. The family office often learns of the incident after the budget has moved.

Six Places to Start

1. Name one owner for new AI tools. A short approved list and one accountable person, often the chief operating officer or head of IT, gives the executive assistant and the controller a clear answer when a polished “Connect” page appears.

2. Teach one sign-in habit to staff and family: open the vendor's site yourself. Typing the address or using a saved bookmark takes ten seconds and defeats a lure delivered by ad, message, or link.

3. Move principals, executive assistants, and finance staff to passkeys or hardware security keys first. These roles hold the access an attacker wants most, and phishing-resistant authentication closes the gap that live-operator phishing exploits.

4. Give the page a simple test. A real browser window can be dragged outside the browser. A drawn one cannot. Staff who see a login window that stays trapped inside the page have spotted the technique.

5. Audit what a stolen login could change. Review mailbox forwarding rules, delegates, recovery contacts, and user permissions at custodians and banks on a regular cadence. After any suspected exposure, review every account that identity could reach for new administrators, changed recovery details, and unapproved activity.

6. Extend the same review to family brands and portfolio companies. List who holds administrator rights on ad and marketing accounts, which payment methods are stored, and who receives billing alerts.

What We’re Watching

AI brand names are becoming the most effective costume in phishing, and new lures follow the news cycle. Each model or agent launch is a fresh opening within days. For family offices, the practical response is a documented approval path for AI tools and phishing-resistant authentication for the people closest to the money. Our expanded governance and AI risk module, launching with the 2026 survey cycle, helps offices benchmark both.

Meet us live! Join us as TCF speaks on “How AI Is Rewriting the Rules of Family Office & Wealth Management Security Culture”. October 29 in San Francisco.

Take the survey. Our Family Office AI Adoption and Cybersecurity survey is open, and your input helps shape the benchmarks we publish for the family office community.

Talk to us. Curious how your family office handles a new AI tool asking to “Connect”? A Confidence Check is a no-obligation conversation to find out.