Fake Claude Max giveaway tricks users into handing over their Google account credentials
Malwarebytes found a fake Claude Max giveaway that steals Google credentials via a spoofed sign-in.
Malwarebytes found a phishing page copying Claude branding that claims Anthropic is giving away 10,000 free one-month Claude Max subscriptions. A countdown advertising fewer than 760 remaining slots is generated locally and resets when the page reloads. Clicking Google draws a draggable fake browser window with a padlock and a correctly spelled Google sign-in address, after a human-verification step. The phishing function loads from an external reusable widget whose comments are in Russian and call the visitor the victim; a compromised Google account can expose email, documents, password resets, and Claude access.
- Fake page offers 10,000 free one-month Claude Max subscriptions.
- A shrinking slot counter is generated in the browser and resets on reload.
- Only the Google button proceeds; Apple and email options are disabled.
- A draggable fake browser window shows a correctly spelled Google address.
- Credential-stealing code loads from a reusable widget with Russian comments.
- Products
- ClaudeClaude Max
- Organizations
- MalwarebytesAnthropicPalo Alto NetworksMicrosoft
- AI models
- Claude
From the original article
2 min read at helpnetsecurity.com
A fake Claude Max giveaway uses a spoofed Google sign-in window to steal users’ login credentials, Malwarebytes researchers have found. “Browser-in-the-browser” is not a new technique. Researchers have documented it since 2022, and in June Palo Alto Networks’ Unit 42 reported a campaign that used draggable fake browser windows to target Microsoft 365 users.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.