VULNpocalypse
MediumEcosystem changeActive

Anthropic-themed phishing bypasses email gateways, Dark Reading reports

Dark Reading reports fake Anthropic invite emails slipping past email gateways to steal Google and Microsoft logins, so enforce phishing-resistant MFA.

Published
Exploitation
Yes, Dark Reading reports Cofense found the campaign sending emails since September, but the number of victims is not confirmed

What happened

Dark Reading reports, citing a blog post by Cofense, that an unidentified threat actor has been sending phishing emails worldwide since September that pretend to offer early access to a “new social media AI tool” from Anthropic, with the goal of stealing Google and Microsoft account credentials (Dark Reading).

According to Dark Reading, Cofense says the emails got past the Proofpoint Secure Email Gateway (SEG) and Microsoft Defender for Office 365, even though they contain obvious red flags: a grammatical error in the subject, a sender name reading “Austin from nthropic” and no Anthropic branding (Dark Reading).

The flow, as described by Cofense via Dark Reading (Dark Reading):

  • Emails are sent from the legitimate shared address customercare@gotowebinar[.]com, which any GoTo Webinar user can send from.
  • The registration link is run through Zapier’s URL shortener, hiding the real domain from scanners.
  • A Cloudflare CAPTCHA appears before a fake Zoom page. From Oct. 28 the actor began spoofing Anthropic’s website instead of Zoom’s.
  • A second, malicious CAPTCHA, designed to block VPNs, Tor and other defender tools, sits before a fake Google or Microsoft single sign-on page. Dark Reading notes the Google path does not even prompt for a password.

Cofense researcher Jacob Malimban says generative AI was “likely” used because of the multiple variations of the fake pages, but Cofense could not confirm it (Dark Reading).

Not confirmed: the identity of the actor, how many people were targeted or had credentials stolen, and whether Anthropic, Proofpoint, Microsoft or GoTo have commented. Dark Reading is the only outlet carrying this story.

Am I affected?

  • You may be exposed if your organisation relies on Proofpoint SEG or Microsoft Defender for Office 365 as its main email filter, since Cofense reports these emails passed both (Dark Reading).
  • Indicators reported by Dark Reading: sender customercare@gotowebinar[.]com, a lure about a “private, invitation-only” Anthropic preview, a Zapier-shortened link, and a landing page posing as Zoom or Anthropic that offers Google or Microsoft SSO (Dark Reading).
  • Specific phishing domains or URLs are not confirmed in the source.

What to do now

  1. Search mail logs for messages from customercare@gotowebinar[.]com mentioning Anthropic or a “private preview”, and for Zapier-shortened links, using the indicators reported by Dark Reading.
  2. For any user who clicked through to the SSO page, reset the credentials and review recent sign-in activity for the Google or Microsoft account.
  3. Enforce phishing-resistant MFA, least-privilege access and privileged access management, as recommended by Keeper Security CISO Shane Barney, who says organisations should assume phishing emails will reach inboxes (Dark Reading).
  4. Use a password manager that validates domains before autofilling credentials, which Barney describes as a last line of defense against lookalike domains (Dark Reading).
  5. Set up account monitoring, for example with CISA’s free Logging Made Easy tool, and train staff to recognise and report phishing, as Cofense’s Malimban suggests (Dark Reading).

Sources