Phony Anthropic Offer Steals Google Logins

A new phishing scam is targeting users by impersonating Anthropic and offering a fake giveaway of its Claude Max AI service. The deceptive offer, which claims to provide free access to Claude Max with enhanced limits, leads users to a malicious Google login page designed to steal credentials. This scam is particularly concerning due to its highly convincing presentation, including authentic-looking logos, invented reviews, and a fake counter of claimed giveaways.

The fake login page utilizes a "browser-in-a-browser" trick, displaying a pop-up window that mimics a genuine Google sign-in interface. This technique is advanced enough to fool users who do not inspect the page closely. The scam's goal is to gain access to a user's Google account, which can then be used to compromise associated services like Gmail and Google Docs. Security researchers note that the fake giveaway's presentation is carefully crafted to appear legitimate, differentiating it from simpler phishing attempts.

Experts advise caution when encountering such offers. Key indicators of a fake login prompt include the inability to drag the pop-up window outside the main browser window, a password manager failing to populate fields, and the offer not being discoverable on the legitimate company's website. The presence of disabled login options, like the one for Apple in this scam, also serves as a red flag, steering users towards the intended Google sign-in trap. Developers found Russian language comments in the web page's components, though this is not conclusive evidence of the scammer's identity.