Google Account Phishing Trap Lures Claude Max Users with Fake Giveaway
A new phishing campaign has been uncovered by Malwarebytes, targeting users of the AI platform Claude Max. The attackers are using a convincing fake giveaway to lure victims into signing in with their Google account, which can provide access to email, documents, and password-reset messages for other accounts.
The fake giveaway claims that Anthropic is thanking 100 million users by giving away 10,000 free one-month subscriptions to Claude Max. However, the presentation is careful, including real logos and colors, invented five-star reviews, and a long footer with links to genuine Anthropic pages.
What makes this sample instructive is how little the operator had to do. The malicious functionality is loaded through a single line of code from an outside service that presents itself as a reusable sign-in widget and provides installation instructions.