Fake Anthropic AI Preview Phishing Campaign Targets Google & Microsoft Credentials
What Happened — Since September 2026, threat actors have been sending emails that masquerade as an exclusive invitation to preview Anthropic’s next‑generation AI model. The messages use the legitimate GoTo Webinar service to appear authentic, embed a shortened URL (zpr[.]io), and include a CAPTCHA to thwart automated analysis. Recipients who click the link are directed to a credential‑phishing page that harvests Google and Microsoft login details. The campaign leverages the current hype around generative AI to increase click‑through rates, and the stolen credentials can be used to access sensitive corporate documents or as a foothold for deeper intrusion. Cofense’s Active Threat Reports (ATRs 423868, 423866, 423475) provide the full infection chain and IOCs.
Why It Matters for Trust & Control Assurance — The lure demonstrates that traditional email filters alone are insufficient; robust security‑awareness training and strong credential controls are essential control objectives.
Who Is Affected — Enterprises across technology, finance, and any sector evaluating AI tools; SaaS vendors that use webinar platforms for legitimate communications.
Recommended Actions
- Reinforce security‑awareness programs with AI‑themed phishing simulations.
- Enforce MFA on all Google and Microsoft accounts and monitor for anomalous logins.
- Deploy URL‑filtering that expands short links and blocks known malicious domains.
- Validate that webinar‑related emails are verified through DMARC/DKIM and that senders are whitelisted.
- Incorporate phishing‑incident evidence into audit artifacts for credential‑access controls.
Technical Notes
- Attack vector: Phishing email → shortened URL (zpr[.]io) → CAPTCHA‑protected credential page.
- Abused services: GoTo Webinar (legitimate meeting platform).
- Indicators: Sub‑domains with dash characters, malicious URLs, phishing email templates.
Source: Cofense Intelligence