Cyberattacks | Data breaches

Sloppy Fake Anthropic Invites Slip Past Major Email Security Tools

A phishing campaign promising a private AI preview has dodged Proofpoint and Microsoft Defender filters since September to harvest work logins.

By Content Team

Nov 2, 2026

ON THIS PAGE

A surprisingly clumsy phishing campaign impersonating Anthropic has been bypassing Proofpoint’s Secure Email Gateway and Microsoft Defender for Office 365 since September 2026, Cofense researchers found. Attackers send fake “private preview” invites to an Anthropic AI tool from a legitimate GoTo Webinar address, then route victims through a fake Zoom page to steal Google or Microsoft logins.

The emails carry a misspelled sender name (“Austin from nthropic”), a grammatical error in the subject line, and zero Anthropic branding. The theft flow is half-broken, too: the Google path never asks for a password. Since October 28, the attackers have swapped the Zoom page for a fake Anthropic one.

Yet Cofense points to three simple tricks that may explain the bypass: a sender address open to every GoTo Webinar account holder, Zapier-shortened links, and two CAPTCHAs that keep scanners and VPNs from following the chain. Keeper Security chief information security officer Shane Barney argues email gateways will always have blind spots, so defenses should focus on identity, including phishing-resistant multifactor authentication.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?