Phishing & fraudmedium
Discounted Claude access bought on the gray market may expose every prompt you send
- Tags
- phishing-fraud
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bitsender.top | tive ones. The main domain for Poison Claude, poison-claude.bitsender[.]top, ran behind Cloudflare’s CDN, hiding its originating IP a |
| domain | claudeopus.shop | a phishing warning on the site, but had taken no action on claudeopus[.]shop even though that domain also runs behind Cloudflare. Ecom |
| domain | qq.com | sed by Chinese internet users, and the top email domain was qq.com, which is a popular email service in China,” Okta wrote. Th |
From the original article
3 min read at helpnetsecurity.com
More than half a dozen services advertised on underground forums and messaging platforms, offering discounted or “unlimited” token access to frontier AI models , were discovered by Okta. Okta believes the trend is likely driven by Chinese users seeking access to AI models that are unavailable because of regulatory and provider restrictions. “The demand is driven by both cost and restrictions on access.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.