Cofense Reports Anthropic-Themed Phishing Emails Bypassing Email Security Tools
Summary
Cofense reports that an unidentified actor's fake Anthropic early-access emails are reaching major email security tools and targeting Google and Microsoft credentials, using shortened links and CAPTCHAs; AI involvement remains unconfirmed.
Key points
- Cofense says an unidentified actor has sent fake Anthropic early-access invitations since September to steal Google and Microsoft account credentials.
- The messages lead targets through fake Zoom or Anthropic pages and may prompt them to sign in using Google or Microsoft SSO.
- Cofense reported that the emails reached Proofpoint Secure Email Gateway and Microsoft Defender for Office 365.
- The campaign uses a legitimate shared webinar sender address, shortened registration links, and two CAPTCHAs that can hinder automated scanning and defender tools.
- Cofense could not confirm AI use; a change to Anthropic-themed spoofing pages and variations in the fake pages were cited as possible signs.
- The article recommends phishing-resistant MFA, least-privilege access, privileged access management, employee phishing awareness, and account monitoring.
Article Details
- Event Type
- Anthropic-impersonation phishing campaign using fake webinar invitations, shortened registration links, CAPTCHAs, and fake Zoom or Anthropic pages to pursue credential theft.
- Impact
- Cofense reported that campaign emails bypassed Proofpoint Secure Email Gateway and Microsoft Defender for Office 365. The campaign sought Google and Microsoft account credentials; the article does not confirm that credentials were stolen or accounts compromised.
MITRE ATT&CK
People
Jacob MalimbanCofense researcher who described the campaign, its phishing flow, and evidence that the later spoofed pages may have been generated with AI.Shane BarneyKeeper Security chief information security officer who commented on email-security blind spots and recommended defenses against credential compromise.
Vendors
CloudflareLastly, the phishing flow incorporates two separate CAPTCHAs. The first — a Cloudflare CAPTCHA, presented before the fake Zoom or Anthropic page — is meant to stop an automated scanner in its tracks.Googleearly access to Anthropic's cutting-edge artificial intelligence (AI) technology. Their goal: stealing Google and Microsoft account credentials.Microsoftto Anthropic's cutting-edge artificial intelligence (AI) technology. Their goal: stealing Google and Microsoft account credentials.ProofpointIn fact, Cofense found these emails getting through market-leading email security products like the Proofpoint Secure Email Gateway (SEG) and Microsoft Defender for Office 365. Cofense pointed to a few little
Products
GoTo Webinarerror. The email sender's name includes a typo — "Austin from nthropic" — and their domain belongs to GoTo Webinar, not Anthropic. Visually, the messages are barebones, possessing no visual elements that even attemptMicrosoft Defender for Office 365market-leading email security products like the Proofpoint Secure Email Gateway (SEG) and Microsoft Defender for Office 365. Cofense pointed to a few little details that might help explain why.Microsoft Single-Sign On (SSO)a GoTo Webinar invite led to a Zoom call, they might choose to sign into Zoom via Google or Microsoft Single-Sign On (SSO). If they choose Google, they won't even be prompted for a password, thus making half of thisProofpoint Secure Email Gateway (SEG)found these emails getting through market-leading email security products like the Proofpoint Secure Email Gateway (SEG) and Microsoft Defender for Office 365. Cofense pointed to a few little details that mightZoom— a link that doesn't point to an Anthropic or even a conferencing app domain — they'll end up on a fake Zoom meeting page. If, further, the victim doesn't catch that a GoTo Webinar invite led to a Zoom call, they