Anthropic-themed phishing emails bypass secure email gateways
Original title: Anthropic-Themed Phishing Emails Bypass Top Security Tools
Since September, an unnamed actor has used fake Anthropic previews to steal Google and Microsoft credentials.
Cofense describes a global phishing campaign in which emails offer early access to a supposed private Anthropic AI tool. The messages contain typos, come from a GoTo Webinar domain, and lead to a fake Zoom page offering Google or Microsoft single sign-on. Cofense says obvious lures are still passing some leading secure email gateways. Google sign-in on the fake page does not prompt for a password.
Unconfirmed: The actor is unidentified, and gateway bypass is Cofense's assessment of this campaign.
- The lure is an invitation-only preview of a "new social media AI tool."
- The sender name is misspelled as "Austin from nthropic."
- Shortened URLs, CAPTCHAs, and legitimate conferencing tools are used.
- The registration link does not point to Anthropic or a conferencing domain.
Impact: Theft of Google and Microsoft account credentials
- 1.Treat Anthropic early-access mail from a GoTo Webinar domain as phishing.
- 2.Do not complete Google or Microsoft SSO on the linked fake Zoom page.
- Products
- GoTo WebinarZoom
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gotowebinar.com | ails are sent from a legitimate email address, customercare@gotowebinar[.]com — a shared sender address that any GoTo Webinar user migh |
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 142a2e80d6a5fef7c9df2e421245edcb | ing-fortune-500-brands#recipe=similar-items&sourcecontentid=142a2e80d6a5fef7c9df2e421245edcb) Operation DoppelBrand: Weaponizing Fortune 500 Brands by |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
8 min read at darkreading.com
Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products.
By Nate Nelson · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.