Claude Max Giveaway Scam Tricks Users with Spoofed Google Sign-In Window

A new phishing campaign has been uncovered by Malwarebytes researchers, targeting users of Google accounts and attempting to trick them into handing over their login credentials.

The scam takes the form of a fake Claude Max giveaway, with the promise of a free upgrade to the paid service. The campaign is particularly convincing because it does not ask for payment details or require users to download any malware.

In fact, the only way to sign in is through Google, and even then, the page displays a browser window within the existing tab that appears to be a legitimate Google sign-in form. However, this is actually a spoofed window that prompts users for their login credentials.

The researchers note that the code behind this campaign appears to be a maintained, reusable product rather than something built for this one effort, suggesting that the attackers may be using a pre-existing tool to target multiple services.