Fake Anthropic AI previews lure in overeager employees
Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview. In reality, adversarial actors are trying to steal Google and Microsoft login credentials,…
Cybersecurity experts warn of a new phishing scam targeting enterprise employees who may be enticed by an invite to a private, invite-only Anthropic preview. The malicious emails appear to be legitimate invitations from GoTo Webinar and use subdomains and dashes to conceal the malicious URL. Victims are prompted to enter their work email address and, after clicking "Continue with Google" or "Continue with Microsoft," are directed to a fake login page.
The fake login pages are designed to mimic the legitimate Google and Microsoft pages. Once credentials are submitted, attackers can exploit the stolen information to compromise accounts and gain access to sensitive documents or use it as a stepping stone for further enterprise infiltration. Security experts advise checking for inconsistencies in branding, such as minor misspellings, and remind employees to scrutinize URLs and domains for signs of phishing attempts.
Implementing phishing-resistant multi-factor authentication (MFA) such as passkeys can significantly reduce the value of stolen passwords.
Written by urgent.news from Computerworld's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
