Anthropic-Themed Phishing Emails Bypass Major Security Tools

Since September 2026, a phishing campaign masquerading as Anthropic has slipped past industry-leading secure email gateways [[S1], [S3]]. Cofense uncovered the operation, which lures recipients with promises of early AI access to harvest Google and Microsoft credentials [[S1], [S3]].

The messages are crudely designed, riddled with grammatical slips and sender-name typos like "Austin from nthropic" (Dark Reading). They exploit GoTo Webinar domains instead of Anthropic’s official infrastructure to invite victims to a supposed private preview of a social‑media AI tool.

When recipients follow the registration links, they land on counterfeit Zoom meeting pages rather than legitimate conferencing or AI sites. The fake pages then prompt sign‑in via Google or Microsoft SSO, with Google logins bypassing password prompts entirely.

Despite the campaign’s basic execution, Cofense observed that it consistently evaded top products such as Proofpoint Secure Email Gateway and Microsoft Defender for Office 365. The attackers achieved this by shortening malicious URLs, inserting CAPTCHAs, and using legitimate video‑conferencing services [[S1], [S3]].

Researcher Jacob Malimban at Cofense noted generative AI likely powered the varied Zoom page copies. Starting Oct. 28, the threat actor began spoofing Anthropic’s website directly, a change that further hints at automated page generation.

The campaign exposes organizations to credential theft, leakage of proprietary documents, and deeper network infiltration (Cofense). Cofense has compiled related indicators of compromise into active threat reports, highlighting ATRs 423868, 423866, and 423475 for this operation.

Employees should remain alert to phishing emails that misuse legitimate tools to dodge detection. Security teams can rely on human‑vetted threat‑intelligence reports to map the infection chain and apply appropriate mitigations.

The success of a rudimentary phishing campaign against advanced secure email gateways suggests that threat actors are increasingly relying on topical AI lures rather than sophisticated technical exploits. By piggybacking on high-demand artificial intelligence previews, attackers appear to be exploiting human eagerness for technological access while bypassing traditional gateway filters through the abuse of legitimate utility tools.

Spotted an error? See our corrections policy or email editorial@lordofclaude.com.