Fake Anthropic preview invites phish Google and Microsoft logins
Original title: Fake Anthropic AI previews lure in overeager employees
Cofense says the lures use GoTo Webinar branding, a URL shortener, and two CAPTCHA pages before credential prompts.
Cofense describes a phishing campaign that poses as a private, invite-only Anthropic preview to steal work credentials. Emails appear to come from customercare@gotowebinar[.]com with the display name “Austin from nthropic,” then send recipients through a shortened link, a compromised URL, and Cloudflare CAPTCHAs to a Zoom-spoofed registration page. The fake Google page collected only usernames, which researchers surmise is a misconfiguration, while the Microsoft page collected usernames and passwords. Neither page confirmed login or redirected to a real vendor site.
Unconfirmed: Researchers only surmise that the Google page’s username-only collection is a misconfiguration.
- The sender name drops the “A” in Anthropic, a detail Cofense flags as a warning.
- Fake Google host is goo[.]gle-access-eventregister[.]icu; Microsoft uses office[.]com-access-sharepoint[.]com.
- A Zapier-looking link and two CAPTCHA steps are described as blocking scanners and analysis tools.
- Stolen credentials could open documents or serve as an initial enterprise foothold, Cofense says.
Impact: Theft of Google and Microsoft work login credentials
- 1.Prefer phishing-resistant MFA such as passkeys so a stolen password is less useful.
- 2.Check that email branding, sender name, and login domain stay consistent across the flow.
- Products
- GoTo Webinar
- Organizations
- Cofense
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | goo.gle-access-eventregister.icu | , and their subdomains are “tricky.” The fake Google URL is goo[.]gle-access-eventregister[.]icu, while the Microsoft URL closely mimics real Office and |
| domain | gotowebinar.com | (MCP). The email sender address appears to be customercare@gotowebinar[.]com (GoTo Webinar’s website is actually www.goto.com ). The t |
| domain | office.com-access-sharepoint.com | RL closely mimics real Office and Sharepoint domains, using office[.]com-access-sharepoint[.]com. Once credentials are submitted, neither login offers a |
From the original article
4 min read at csoonline.com
Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.