Fake Anthropic previews phish Google and Microsoft credentials
First merged summary.
Cofense says a GoTo Webinar-branded lure still steals work logins through fake Zoom and SSO pages.
Cofense describes a global phishing campaign, active since September, that offers early access to a supposed private Anthropic AI tool to steal work credentials. Messages come from customercare@gotowebinar.com under the misspelled display name “Austin from nthropic,” then route recipients through a shortened or Zapier-looking link, a compromised URL, and two Cloudflare CAPTCHAs to a Zoom-spoofed registration page. That page offers Google or Microsoft sign-in; according to Cofense, the Google page collected only usernames, which researchers surmise is a misconfiguration, while the Microsoft page collected usernames and passwords. Neither confirmed login nor redirected to a real vendor, and Cofense says the obvious lures still pass some leading secure email gateways.
- Sender display name is “Austin from nthropic,” dropping the A.
- Lure is an invite-only preview of a “new social media AI tool.”
- Google fake host: goo.gle-access-eventregister.icu; Microsoft: office.com-access-sharepoint.com.
- Google page collected usernames only; Microsoft collected usernames and passwords.
- Shortened links, two CAPTCHAs, and conferencing branding are used to hinder scanners.
What each outlet adds
beyond the shared facts- CSO OnlineNames fake SSO hosts, CAPTCHA steps, and the username-only Google page.
- Dark ReadingCampaign since September, global, and bypassing some email gateways.
Coverage
oldest first · one row per article · UTC- · 1d ago
CSO OnlineFirst report
Fake Anthropic preview invites phish Google and Microsoft logins
Cofense says the lures use GoTo Webinar branding, a URL shortener, and two CAPTCHA pages before credential prompts.
- · 1d ago
Dark Reading
Anthropic-themed phishing emails bypass secure email gateways
Since September, an unnamed actor has used fake Anthropic previews to steal Google and Microsoft credentials.