Phishers Targeting Claude Max Users with Fake Freebie Offers

A new phishing scam is targeting users of Anthropic's Claude Max service, promising free access to extended thinking and priority access to Opus and Sonnet. However, the real goal is to steal Google login credentials, potentially leading to unauthorized access to Gmail, Google Docs, and other non-Google accounts tied to the victim's Google information.

The scam, reported by Malwarebytes, features a convincing website with real logos, colors, and reviews. The page includes a running counter showing how many of the promised 10,000 free accounts have been given away, adding to its legitimacy.

Clicking on the offer leads to a login page that employs a browser-in-a-browser trick, making it appear as though the user is logging in to a real Claude account. However, the login prompt might convince users who don't examine the login page carefully, and if someone's Claude account is tied to their Google account, the attacker gains access either way.

Malwarebytes has offered some tips for detecting fake browser windows, including dragging the window outside the browser, checking with a password manager, verifying links by searching on the company's actual website, and being cautious of single sign-in options and countdowns. It is unclear how widespread this scam has become or how many people it has reached.