Attackers are sending fake, exclusive Anthropic AI-event invitations that use familiar GoTo Webinar branding to lure enterprise employees. Victims who register are routed through CAPTCHA checks, a fake Zoom-style event page, and spoofed Google or Microsoft sign-in pages designed to steal work credentials.
This campaign used an invitation only Anthropic AI preview as bait, promising a focused conversation on frontier AI models to a select group of recipients. The email impersonated GoTo Webinar and appeared to come from customercare@gotowebinar[.]com, but the displayed sender name read Austin from nthropic, dropping the A in Anthropic. Clicking the registration link sent victims through a shortened, compromised URL and a CAPTCHA page before landing on a Zoom style registration page. From there, choosing Continue with Google or Continue with Microsoft triggered a second CAPTCHA and finally a spoofed Google or Microsoft sign in page designed to harvest work credentials.
The lure exploited curiosity and fear of missing out around a private preview of new AI technology, which is the kind of invitation an ambitious employee would want to accept without delay. The attack also layered legitimate looking elements such as GoTo Webinar branding, CAPTCHA checks, and familiar Google or Microsoft login pages, each of which made the overall flow feel routine even though it changed branding at every step. CAPTCHA pages were reportedly included specifically to block security scanners and automated analysis tools, extending the campaign's reach before detection.
Employees should verify unexpected AI preview or private event invitations through a known account representative or trusted contact before registering, rather than acting on urgency alone. Teams should be trained to stop and investigate whenever branding changes across an email, a meeting page, and a sign in page, since that inconsistency is a strong indicator of a credential phishing flow. Readers should also get in the habit of checking the full domain on any sign in page, since logos and page design can be convincingly mimicked even when the underlying domain is not legitimate. Finally, organizations should have a clear process for employees to reset passwords and request an account activity review immediately if they suspect they entered credentials into one of these pages, since the damage is done as soon as credentials are submitted.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Victims get an invitation email impersonating GoTo Webinar for an exclusive Anthropic session, then are routed through CAPTCHA checks, a Zoom-spoofed registration page, and finally a fake Google or Microsoft sign-in page that captures their work credentials.
The sender name is listed as Austin from nthropic, missing the A in Anthropic, and the branding shifts from GoTo Webinar to Zoom to Google or Microsoft across the flow, which is inconsistent with a legitimate event registration.
Reset the password immediately and have the account's activity reviewed, since attackers have already captured the credentials once they are submitted.
The fake Microsoft page captures both usernames and passwords, while the fake Google page reportedly captures only usernames.
An exclusive Anthropic AI preview? Check who invited you. The email looks like GoTo Webinar. Its short link leads through CAPTCHAs to a Zoom-style registration page, then asks you to continue with Google or Microsoft. That brand-hopping is the tell. The Microsoft lookalike at office[.]com-access-sharepoint[.]com isn't Microsoft, and it collects your work username and password. Before registering, ask your known Anthropic contact if the invitation is real.
Threat actors sent fake invitations to an exclusive Anthropic AI preview to steal Google and Microsoft work credentials. The campaign abused trusted services, including GoTo Webinar and a URL shortener, then used CAPTCHA pages and convincing fake login screens to make detection harder. Employees…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Attackers are sending fake ChatGPT billing emails that pressure people to “update payment” within 48 hours to avoid service interruption. The message links to a convincing look‑alike ChatGPT login page via a Google redirect, aiming to steal OpenAI credentials.
