Cybersecurity · VIDEO
Phishing with fake Anthropic invitations: how they steal Google and Microsoft credentials
A new phishing campaign exploits interest in Anthropic previews to steal Google and Microsoft credentials. The attacks use GoTo Webinar and Zoom branding to deceive users, bypassing security systems with CAPTCHAs and sophisticated URLs.
KEY TAKEAWAYS
- Phishing with fake invites for Anthropic previews steals Google and Microsoft credentials
- Attackers exploit GoTo Webinar and Zoom branding to bypass security systems
- CAPTCHA and sophisticated URLs block security tools, facilitating credential theft
- MFA phishing-resistant and invite verification are essential for corporate defense
Transcript
A sophisticated phishing campaign is targeting corporate employees, exploiting interest in exclusive previews of Anthropic. Cybercriminals use GoTo Webinar and Zoom branding to deceive users, stealing Google and Microsoft credentials.
The attack exploits Fear Of Missing Out, or FOMO, in corporate environments. Phishing emails contain small spelling errors and suspicious URLs. Two CAPTCHAs are used to block security tools, and fake login pages are extraordinarily similar to legitimate ones.
Research by Cofense reveals that attackers send emails appearing to come from a legitimate sender, exploiting the fact that GoTo Webinar invitation emails are generally not blocked by security tools. The email offers an invitation to a private and confidential virtual session on AI systems.
Attackers use a URL shortener and subdomains with hyphens to hide the malicious URL. The sender's address appears to be customercare@gotowebinar[.]com, while the official GoTo Webinar website is www.goto.com.
Upon clicking the phishing link, a Cloudflare CAPTCHA page appears, followed by an invitation page that mimics Zoom. Users must register by providing their corporate email address. Upon clicking "Continue with Google" or "Continue with Microsoft," a second CAPTCHA appears.
The fake login pages for Google and Microsoft are extraordinarily similar to the legitimate ones. However, the fake Google login page only captures usernames due to an alleged misconfiguration, while the Microsoft one collects both usernames and passwords.
Once the credentials are sent, attackers can compromise the account, access sensitive documents, or use the account as an initial attack vector to further infiltrate the company.
Frank Dickson of Dickson Research emphasizes that defense should not rely solely on employees analyzing URLs. He suggests verifying any AI preview invitation through an account team or known contact, considering changes in branding from the email to the login page as a warning sign, and implementing phishing-resistant multi-factor authentication (MFA) such as passkeys.
In case of entering credentials on a fake login page, reset the credentials and review account activity. This attack underscores the critical importance of implementing advanced identity access management and multi-factor authentication solutions in companies. Continuous training of employees on emerging security risks is equally crucial.
