Fake Anthropic AI previews lure in overeager employees

Publisher excerpt From CSO Online

Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview. In reality, adversarial actors are trying to steal Google and Microsoft login credentials, exploiting video teleconferencing software GoTo Webinar branding to do so. “It sells exclusivity,” said Frank Dickson of Dickson Research. “Fear of missing out is the oldest lure in the book.” Every organization is trying to figure out where AI fits, he noted, and a private preview of Anthropic’s newest technology is exactly the invitation an ambitious employee would want to accept. “The attackers did not pick Anthropic at random,” he said. “They picked whatever is hottest in the news cycle. Next month, it may be another name.” How attackers lure users with spoofed Anthropic invites GoTo Webinar is a widely used platform, and its meeting invitation emails are typically not blocked by security tools. The Cofense researchers found that attackers are exploiting this fact by sending what seems to be an invitation email from a legitimate sender; when users click on the link to register for the fake webinar, they are instead sent to a compromised URL. The email offers what the researchers call a “tantalizing” offer: “This private, invitation-only virtual session brings together a select…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.