Cofense has described a phishing campaign that impersonates a private Anthropic AI preview to steal Google and Microsoft work credentials, according to CSO Online on October 29. The email looks like a GoTo Webinar invitation promising an invitation-only session on AI systems and frontier models, a pitch aimed at employees eager to try new tools.
The link passes through several pages before reaching a fake login, where victims are asked to register with a work email and then sign in through Continue with Google or Continue with Microsoft. Both are spoofed pages. Nothing confirms the submission, so victims may not realize anything went wrong. The brands are mixed, with GoTo Webinar in the email, a Zoom-style registration page and Google or Microsoft sign-in screens, and the sender name is missing the first letter of Anthropic, a small warning sign.
The campaign uses a URL shortener and a link generated through Zapier to get past email filters, hides destinations behind subdomains and hyphens, and puts two Cloudflare CAPTCHA pages in the chain to screen out security scanners, VPNs and Tor. The Google page appeared to capture only usernames, possibly through a misconfiguration, while the Microsoft page captures usernames and passwords and closely mimics Office and SharePoint.
Cofense advises verifying AI preview invitations through a known account team, checking that branding stays consistent from email to meeting page to login page, and examining the full domain instead of logos. Phishing-resistant MFA such as passkeys makes stolen passwords less useful, anyone who entered credentials should reset them and review account activity, and awareness training alone is not enough.