Fake Anthropic Preview Steals Work Logins

Threat actors sent fake invitations to an exclusive Anthropic AI preview to steal Google and Microsoft work credentials. The campaign abused trusted services, including GoTo Webinar and a URL shortener, then used CAPTCHA pages and convincing fake login screens to make detection harder. Employees were asked to register for a supposed meeting using their work account.

Key findings

• The lure was an exclusive invitation to preview a new Anthropic AI tool.
• The phishing email appeared to abuse the legitimate GoTo Webinar service and used GoTo Webinar branding.
• Attackers used Zapier's zpr.io URL shortener to help evade email security controls.
• Recipients encountered a Cloudflare CAPTCHA and then a second custom sliding CAPTCHA before reaching the fake login pages.
• The landing page used Zoom branding despite the email using GoTo Webinar branding, creating a detectable brand mismatch.
• The Microsoft replica collected usernames and passwords, while the Google replica reportedly collected usernames only.
• Deceptive subdomains imitated Google, Office, and SharePoint branding to make fraudulent login pages appear legitimate.

Who’s being targeted

• Commonly targeted roles: All employees, Google Workspace users, Microsoft 365 users, Employees evaluating AI tools, Marketing and business teams, Executives and managers.
• Affected industries: Cross-industry organizations using Google Workspace or Microsoft work accounts, Organizations evaluating or using AI tools.
• Attack channels: email, website.
• Impersonated: Anthropic, using apparent GoTo Webinar and Zoom meeting branding, Microsoft sign-in page.

Awareness takeaways

• Check that the organization and service branding remain consistent throughout a meeting invitation and registration process.
• Verify the actual domain before entering work credentials; familiar logos and words within a URL do not make a site legitimate.
• Treat unexpected CAPTCHA checks as a reason to slow down and independently verify the invitation, not as proof that a website is safe.
• Do not enter work credentials into an event-registration page reached through an unsolicited email link; navigate to the provider independently if the invitation seems legitimate.

Red flags to watch for

• The sender name is “Austin from nthropic,” missing the “A” in Anthropic.
• GoTo Webinar branding in the email changes to Zoom branding on the meeting page.
• The URL uses misleading subdomains and dashes rather than an official company domain.
• A CAPTCHA appears before a routine event registration and again before sign-in.
• The domain “office.com-access-sharepoint.com” is not an official Microsoft domain.
• After credentials are entered, the browser does not redirect to the real Microsoft login page or show confirmation.