Phishing with fake Anthropic invitations: how they steal Google and Microsoft credentials

New phishing campaign exploits Anthropic hype to steal Google and Microsoft credentials

A sophisticated phishing campaign is targeting corporate employees, exploiting interest in exclusive previews of Anthropic. Cybercriminals use GoTo Webinar and Zoom branding to deceive users, stealing Google and Microsoft credentials. The attack demonstrates how aggressors exploit current media attention on Anthropic, aiming to exploit the Fear Of Missing Out (FOMO) in corporate environments.

Quick Response

The technical analysis of the campaign

Research conducted by Cofense reveals that attackers send emails that appear to come from a legitimate sender, exploiting the fact that GoTo Webinar invitation emails are generally not blocked by security tools. The email contains an enticing offer: an invitation to a private and confidential virtual session on AI systems, research, and frontier models.

The hiding techniques used

Attackers use a URL shortener to evade email security tools. Additionally, they employ subdomains and hyphens (-) to hide the malicious URL. The link appears to be generated by Zapier, a legitimate company whose tools are compatible with AI models like Claude and ChatGPT.

The sender's address appears to be customercare@gotowebinar[.]com, while the official GoTo Webinar website is www.goto.com. The email contains minimal but revealing spelling errors, such as the sender's name "Austin from nthropic" (missing the "A").

The multi-step authentication process

Upon clicking the phishing link, a Cloudflare CAPTCHA page appears that must be completed before the login request is presented. This security mechanism is used to prevent security tools from scanning the attackers' sites. Once the CAPTCHA is completed, users are directed to an invitation page that mimics Zoom.

To "participate" in the fake event, users must register by providing their corporate email address. Upon clicking "Continue with Google" or "Continue with Microsoft," a second CAPTCHA appears. Both CAPTCHA pages are effective in blocking VPN services, scanners, Tor browsers, and other security tools, making it difficult to fully track the attack.

The fake login pages

The fake login pages for Google and Microsoft are extraordinarily similar to the legitimate ones. However, the fake Google login page only captures usernames due to an alleged misconfiguration, while the Microsoft one collects both usernames and passwords. The fake URLs are designed to be quickly scanned, not carefully read: goo[.]gle-access-eventregister[.]icu for Google and office[.]com-access-sharepoint[.]com for Microsoft.

The implications for corporate security

Once the credentials are sent, attackers can compromise the account, access sensitive documents, or use the account as an initial attack vector to further infiltrate the company. Frank Dickson of Dickson Research emphasizes that defense should not rely solely on employees analyzing URLs.

The recommendations for mitigation

Dickson suggests a short list of actions for companies to defend themselves from this type of scam:

• Verify any AI preview invitation through an account team or known contact
• Consider changes in branding from the email to the login page as a warning sign
• Implement phishing-resistant multi-factor authentication (MFA) such as passkeys
• In case of entering credentials on a fake login page, reset the credentials and review account activity

The campaign demonstrates how attackers exploit trusted tools to evade trust-based defenses. The responsibility for defense should not fall solely on individual employees.

The importance of a robust identity management

This attack underscores the critical importance of implementing advanced identity access management and multi-factor authentication solutions in companies. SOC as a Service solutions can provide continuous monitoring and rapid incident response, reducing the risk of credential compromise.

The need for continuous training

While technical solutions are fundamental, continuous training of employees on emerging security risks is equally crucial. Companies should invest in awareness programs that educate employees to recognize and respond to phishing attacks.

The impact on cyber insurance

Incidents like this can have a significant impact on cyber insurance premiums. Companies must carefully assess their risks and implement adequate security measures to mitigate potential financial losses.

Compliance with NIS2 and DORA

This type of attack highlights the importance of complying with regulations such as the NIS2 Directive and the DORA Regulation. Companies must ensure that their security practices are aligned with these standards to prevent potential sanctions and improve their cloud security posture.

The transition to zero trust architectures

Adopting a zero trust architecture can help mitigate the risks associated with this type of attack. By implementing the principle of "never trust, always verify," companies can reduce the attack surface and improve their sensitive data protection.