Anthropic-themed phishing emails bypass secure email gateways
Since September, an unnamed actor has used fake Anthropic previews to steal Google and Microsoft credentials.
52
- Mentions · 7d0
- Mentions · 30d3
- All mentions7
- First seenSep 18, 2026
- Last mentioned13d ago
Timeline
7 articles · newest firstFake Anthropic preview invites phish Google and Microsoft logins
Cofense says the lures use GoTo Webinar branding, a URL shortener, and two CAPTCHA pages before credential prompts.
52
Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns
FBI warns scammers are cloning 2026 midterm candidates with AI to steal donations and voter data.
66
Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain
Cofense says hotel staff are phished with fake complaints that deliver EtherRAT and TONResolver using blockchain C2.
62
Hackers Target Hotels With Fake Guest Complaints to Deploy Blockchain-Based RAT Malware
Hotel staff are phished with fake guest complaints that deliver EtherRAT and TONResolver using blockchain C2 lookups.
60
Cofense measures employee readiness against real-world phishing threats
Cofense launches Command Center with a Competency Dashboard to measure employee phishing readiness beyond simple training metrics.
25
Hackers Impersonate ChatGPT Subscription Alerts to Steal OpenAI Account Credentials
Cofense reports a phishing campaign using fake ChatGPT subscription payment notices to lure users to credential-harvesting pages and steal OpenAI account logins.
40
Appears with
- TONResolvermalware · 2
- Node.jsproduct · 2
- GoTo Webinarproduct · 2
- EtherRATmalware · 2
- Booking.comorganization · 2
- Googleorganization · 1
- Gartnerproduct · 1
- Anthropicvendor · 1
- US votersvictim · 1
- Ethereumproduct · 1
- FBIorganization · 1
- Microsoftvendor · 1
- TONproduct · 1
- Windowsproduct · 1
- Microsoftorganization · 1
- NetSupport Managermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.