Fake Claude Max giveaway steals Google credentials

Malwarebytes found a fake Claude Max giveaway that steals Google credentials through a spoofed sign-in loaded from a reusable widget.

Malwarebytes Labs reported a phishing page copying Claude branding that offers 10,000 free one-month Claude Max subscriptions and claims Anthropic had passed 100 million users. A countdown advertising fewer than 760 remaining slots is generated locally and resets when the page reloads. Sources disagree on how victims reach the trap: Malwarebytes said every sign-in path leads there, while Help Net Security said only the Google button proceeds, with Apple and email disabled, after a human-verification step. The page then draws a draggable fake browser window inside the tab, complete with a padlock and a correctly spelled Google sign-in address. That window is supplied by a reusable external widget whose comments are in Russian and call the visitor the victim. A compromised Google login could expose email, documents, password resets, and Claude access linked to the account.

• Malwarebytes Labs reported the campaign on 2026-09-23; Help Net Security covered the same findings later that day.
• The phishing page copies Claude branding, offers 10,000 free one-month Claude Max subscriptions, and claims Anthropic had passed 100 million users.
• A slot counter advertising fewer than 760 remaining places is generated locally in the browser and resets when the page reloads.
• Sources disagree on the sign-in flow: Malwarebytes said every path leads to the trap, while Help Net Security said only Google proceeds, with Apple and email disabled, after a human-verification step.
• The trap is a draggable fake browser window drawn inside the phishing tab, with a padlock and a correctly spelled Google sign-in address.
• The fake login loads from a reusable external widget whose comments are in Russian and refer to the visitor as the victim.
• Stolen Google credentials could expose email, documents, password resets, and Claude accounts linked to Google.