Fake Anthropic AI previews lure in overeager employees

Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview. In reality, adversarial actors are trying to steal Google and Microsoft login credentials, exploiting video teleconferencing software GoTo Webinar branding to do so. “It sells exclusivity,” said Frank Dickson of Dickson Research. “Fear of missing out is the oldest lure in the book.” Every organization is trying to figure out where AI fits, he noted, and a private preview of Anthropic’s newest technology is exactly the invitation an ambitious employee would want to accept. “The attackers did not pick Anthropic at random,” he said. “They picked whatever is hottest in the news cycle. Next month, it may be another name.” How attackers lure users with spoofed Anthropic invites GoTo Webinar is a widely used platform, and its meeting invitation emails are typically not blocked by security tools. The Cofense researchers found that attackers are exploiting this fact by sending what seems to be an invitation email from a legitimate sender; when users click on the link to register for the fake webinar, they are instead sent to a compromised URL. The email offers what the researchers call a “tantalizing” offer: “This private, invitation-only virtual session brings together a select group of participants to a focused conversation on AI systems, research, and the future of frontier models,” it reads. A URL shortener circumvents email security tools, and the attackers use subdomains and dashes (-) to hide the malicious URL. The link itself appears to have been generated by Zapier, a legitimate company whose tools are designed to work with Claude, ChatGPT, and other AI compatible with Model Context Protocol (MCP). The email sender address appears to be customercare@gotowebinar[.]com (GoTo Webinar’s website is actually www.goto.com). The text contains no obvious spelling errors, and the email contains GoTo Webinar branding. However, the researchers noted, the email sender’s name is “Austin from nthropic,” with the “A” missing. “Although this is a small misspelling, it is still a useful warning sign,” they pointed out. If the phishing link is clicked, a Cloudflare CAPTCHA page appears, and must be completed before the login prompt is presented. This serves as the first of two checkpoints to prevent security tools from scanning attackers’ websites. “Because CAPTCHAs are common on legitimate websites, phishing recipients may believe all is well and everything is secure,” the researchers explained. Once the CAPTCHA is completed, victims are led to a Zoom-spoofing invitation page. If they want to “attend” the fake event, they must register, and they are prompted to enter their work email address. When they click “Continue with Google” or “Continue with Microsoft,” yet another CAPTCHA page appears. Both CAPTCHA pages seem to be good at detecting and blocking analysis by VPN services, scanners, Tor browsers, and other security tools, the researchers noted. Also, because there are two distinct CAPTCHA pages, such tools may not be able to follow every step in the attack. “A CAPTCHA was built to keep bots out,” Dickson pointed out. “Here, it keeps the security scanners out and lets the victims in.” The fake Google and Microsoft login pages differ a bit, however. The spoofed Google page does not capture passwords, only usernames, which the researchers surmise is due to a misconfiguration; the spoofed Microsoft page does collect both usernames and passwords. But both are “remarkably similar” to their respective legitimate pages, and their subdomains are “tricky.” The fake Google URL is goo[.]gle-access-eventregister[.]icu, while the Microsoft URL closely mimics real Office and Sharepoint domains, using office[.]com-access-sharepoint[.]com. Once credentials are submitted, neither login offers a confirmation message, nor does it redirect to legitimate vendor pages. But by that point, attackers have already succeeded at exfiltrating credentials. That means they could compromise an account, access the sensitive documents in that account, or use it as an initial attack vector to further infiltrate the enterprise, the researchers explained. They advised checking if the branding of a message remains consistent from the email to a login page, searching for small inconsistencies such as minor misspellings, and reminding employees that both the URL and domain determine whether a login page is legitimate. “Although the logos and design of the page may look correct, threat actors are skilled at mimicry,  especially now with the use of AI,” the researchers noted. It’s not the employees’ fault The AI industry’s habit of gated previews and waitlists does not help in these situations, Dickson noted; it trains people to expect exactly this kind of invitation. “Start with the cracks the attackers left showing,” he advised: The sender supposedly came from “nthropic,” the email carried GoTo Webinar branding, the registration spoofed a Zoom meeting page, and the login pages were from Google or Microsoft. That’s three brands in three clicks, he noted. The fake login domains, like office[.]com-access-sharepoint[.]com, are built to be skimmed, not read, he pointed out. And, while the Google page collected only usernames, which may be a configuration error, the threat actors behind this campaign will likely fix that. “Training helps, but I would not hang the defense on an employee squinting at a URL at 4:45 on a Friday,” Dickson said; how much a stolen password is worth is a leadership decision, not a test the employee fails. Phishing-resistant multi-factor authentication (MFA) such as passkeys makes a stolen password far less valuable, he noted. But enterprises ultimately have a short to-do list to allow them to defend themselves from this sort of scam, Dickson said: Verify any AI preview invitation through an account team or a known contact. Treat branding that changes from email to meeting page to login page as a red flag. Roll out phishing-resistant MFA. If someone entered credentials on one of these phishing login pages, reset them and review that account’s activity. “Bottom line: This campaign uses trusted tools to defeat defenses built on trust,” Dickson said. “The employee should not be the last line of defense.” This article originally appeared on CSOonline.