Cofense published 'Would Your Employees Join a Fake Anthropic AI Preview?' on 29 October 2026. It says: "Since September 2026, threat actors have been sending emails that appear to be an invitation to a private Anthropic AI meeting, but are actually attempts to steal Google and Microsoft login credentials."

Cofense says the emails appear to abuse the legitimate GoTo Webinar service, with the sender name reading "Austin from nthropic", and that the link is generated by Zapier's URL shortener. A Cloudflare CAPTCHA leads to a Zoom-spoofing meeting page, then a second, custom sliding CAPTCHA that appears good at blocking VPN services, scanners, the Tor browser and other defender tools, before fake Google or Microsoft login pages.

Cofense says the Google credential phishing page currently only captures usernames, while the Microsoft page captures both username and password, and that these emails bypass current email security technologies. (source: Cofense)

Dark Reading reported on 29 October that Cofense found the emails getting through Proofpoint's Secure Email Gateway and Microsoft Defender for Office 365, and that from 28 October the actor began spoofing Anthropic's website instead of Zoom's, according to Cofense researcher Jacob Malimban. (source: Dark Reading)