Loading story…
A phishing campaign impersonates an Anthropic giveaway offering free Claude Max subscriptions to steal Google account credentials. The lure uses convincing Anthropic branding, links to legitimate Anthropic content, fabricated reviews, a false limited-availability message, and a browser-generated countdown timer to create urgency and credibility.
Rather than redirecting victims to Google, the malicious site displays a draggable browser-in-the-browser overlay that forges a browser address bar, padlock indicator, and Google sign-in URL. The credential-harvesting capability is delivered through a reusable external widget containing Russian-language comments that call targets “victims,” and includes a human-verification step that may impede automated analysis. Compromised Google accounts could expose email, documents, recovery messages, connected Claude accounts, and paid AI-service allowances.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers identified a phishing campaign impersonating an Anthropic promotion for free Claude Max subscriptions to steal Google account credentials. The campaign uses a browser-in-the-browser fake Google sign-in overlay delivered through an externally hosted reusable widget with Russian-language code comments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Oasis Security** disclosed an attack chain dubbed **"Claudy Day"** that combines three flaws in Anthropic’s **Claude** platform to enable covert data theft. The chain starts with attacker-controlled Google search results or fake Claude ads that abuse an **open redirect** on `claude.com`, leading victims to what appears to be a legitimate Claude page. From there, a pre-filled chat URL can carry **hidden prompt-injection instructions** embedded in HTML so the user sees benign text while Claude processes malicious commands in the background. According to the reports, the chained flaws allow attackers to silently instruct Claude to search prior conversations for sensitive information and exfiltrate it through the **Anthropic Files API**, creating an end-to-end path from victim luring to unauthorized data exposure. The issue is notable because it does not require extra tooling, integrations, or MCP servers; built-in Claude features are sufficient for exploitation. A separate report about Claude autonomously exploiting vulnerable websites is **not** the same incident, and a report on the **SideWinder** espionage campaign is unrelated.
Jun 29, 2026
A malvertising and SEO-poisoning campaign is impersonating Anthropic’s Claude AI with the domain `claude-pro[.]com`, luring users to download a trojanized Windows installer that deploys a newly identified backdoor called **Beagle**. Researchers said the fake site appeared in sponsored search results and mimicked Claude branding to distribute a ZIP archive containing an MSI package that installed a legitimate signed G DATA executable alongside a malicious DLL, abusing **DLL sideloading** to begin the infection chain. After execution, the malware decrypts additional payloads, launches DonutLoader, and loads Beagle entirely in memory to reduce disk-based detection. The backdoor provides remote access functions including command execution, file transfer, directory management, and self-uninstallation, and communicates with `license[.]claude-pro[.]com` over TCP 443 or UDP 8080 using a hardcoded AES key. Sophos X-Ops said the campaign has been active for months, uses anti-analysis measures and shared tooling such as a reused XOR key, and relies on infrastructure including Cloudflare and Alibaba Cloud; researchers also noted overlaps with activity linked to **PlugX** operators and related impersonation of vendors including Trellix, CrowdStrike, SentinelOne, and Microsoft Defender.
Jun 29, 2026
Researchers at Manifold disclosed two unpatched vulnerabilities in Anthropic’s **Claude for Chrome** extension that can let a malicious browser extension trigger Claude actions and access sensitive Google Workspace content, including **Gmail messages, Google Docs data and comments, and Google Calendar entries**. The researchers said the flaws were reported in May and remained reproducible in version `1.0.80`, with one issue allowing another extension that has script access on `claude.ai` to simulate a trusted user click and launch hardcoded Claude prompts on the victim’s behalf. The weaknesses stem in part from Anthropic’s earlier mitigation for **ClaudeBleed**, which limited prompts to pre-approved tasks but did not verify that task-triggering clicks came from a real user. Manifold also identified a separate design flaw in which Claude’s side panel can enter a privileged **no-confirmation** mode through a URL parameter, creating a potential privilege-escalation path if a future bug allows outside control of that parameter. The risk is highest when users enable Claude’s **“Act without asking”** mode, because the extension may perform actions without visible consent prompts; Anthropic acknowledged the reports but had not issued fixes, saying one issue was already tracked internally and the other was not externally reachable.
Jul 17, 2026