Cofense finds Anthropic phishing bypassing email security tools

An unidentified threat actor is circulating Anthropic-themed phishing emails since September, aimed at harvesting Google and Microsoft account credentials. Described by Cofense, the campaign bypasses leading Secure Email Gateways (SEGs) such as Proofpoint and Microsoft Defender for Office 365, raising concerns about perimeter security losing effectiveness even against brand impersonations.

The messages push a “private, invitation-only” early access to Anthropic’s AI, but several signs are obvious red flags: aGoTo Webinar sender address (customercare@gotowebinar[.]com) used for distribution, poor branding, and links that route to a fake Zoom meeting page rather than any legitimate Anthropic or conferencing domain.

Cofense researchers note the attackers use simple tricks that still work: URL shortening via Zapier to obscure the malicious link, and a phishing flow that integrates two CAPTCHAs—one before the fake conference page and another before a fake SSO page—to hinder automated scanners and deter defenders using VPNs or Tor. In some variants, victims who click the registration link are directed to a Zoom page and may be prompted to sign in with Google or Microsoft SSO, potentially bypassing password prompts.

The evidence includes spoofing of Zoom and, later, Anthropic’s site, with researchers such as Jacob Malimban suggesting AI generation is likely given the variations. Industry input from Keeper Security’s CISO Shane Barney stresses that SEGs will always have blind spots and that protecting credentials and enforcing least-privilege remains essential. 29 October 2026