A clumsy Anthropic-branded phishing campaign slips its lures past Proofpoint and Defender: the flaw is in design, not AI

By Dark Reading · October 29, 2026.

A phishing campaign impersonating Anthropic has managed to reach inboxes despite being, thanks to its own flaws, very easy to spot. According to a post by security firm Cofense, reported by Dark Reading, an unidentified actor has been sending emails since September offering supposed early access (a "private preview", invitation-only) to a new social AI tool from Anthropic. The goal is to steal Google and Microsoft credentials.

Cofense says the messages got past market-leading secure email gateway products (SEGs: filters that inspect email before it reaches the user), including Proofpoint Secure Email Gateway and Microsoft Defender for Office 365.

The red flags are plentiful, according to the report: grammatical errors in the subject line, a sender named "Austin from nthropic", no visual elements imitating the brand, and a domain that belongs to GoTo Webinar, not Anthropic. The registration link points neither to Anthropic nor to a videoconferencing app, but to a fake Zoom page. Since October 28, the attacker has also been spoofing Anthropic's website instead of Zoom's.

Cofense attributes the campaign's success to three factors. First, the email comes from a legitimate, shared GoTo Webinar address (customercare@gotowebinar[.]com), which gives the sender cover. Second, the malicious link runs through Zapier's URL shortener, which prevents the filter from evaluating the real domain. Third, the flow includes two CAPTCHAs: one from Cloudflare to stop automated scanners and another, between the fake page and the single sign-on (SSO) page, designed to block VPNs, Tor browsers and defenders' tools.

Cofense could not confirm that generative AI was used, although its researcher Jacob Malimban believes it likely, given the multiple variants of the fake Zoom pages and the "similar but slightly different" format of the Anthropic imitation. That is an inference, not an established fact. The report itself points out a flaw on the attacker's part: if the victim chooses Google, they are not asked for a password, so that half of the flow is useless.

Our take: the tempting headline is "AI democratizes phishing," but the data point elsewhere. What stands out here is not sophistication, but that basic tactics work against expensive filters. When a defense relies on sender reputation and domain analysis, putting a legitimate service in the middle (webinars, URL shorteners) is enough to blind it. The attacker doesn't beat the filter; it goes around it using trusted infrastructure.

There is also a brand irony. Anthropic is a credible lure today because the public expects "early access" to AI tools, and that expectation is the bait. In general, the faster the industry moves, the easier it is to fabricate a plausible invitation to the "next big thing." Novelty is a social engineering vector.

The recommendation from Shane Barney, CISO of Keeper Security, is the sensible one: assume phishing will reach the inbox and build defenses around identity. That means least privilege, phishing-resistant multi-factor authentication, privileged access management and password managers that validate the domain before autofilling. It should be noted that Keeper Security sells precisely this kind of solution, although the advice is consistent with standard industry practice.

In the short term, the transition is uncomfortable: attackers automate variants at near-zero cost and perimeter defenses are aging. In the long term, the same AI that makes fraud cheaper will enable behavior- and identity-based detection that is much harder to evade with a URL-shortener trick. Meanwhile, the evergreen lesson is unglamorous: don't count on the filter to save you, and design the system so that a stolen credential doesn't unlock everything.