![\"Illustrative](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/11\/fake-anthropic-ai-preview-scam-webinar-invite-illustration.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nAn exclusive event is the reason to sign in<\/h3>\n
The fake Anthropic AI preview scam invites employees to a private event, then directs them toward imitation account screens. The supposed preview provides the reason to register.<\/p>\n
Cofense\u2019s investigation<\/a> documents the phishing chain. It distinguishes a Microsoft password-stealing branch from an observed Google version that collected usernames only.<\/p>\n The campaign abuses legitimate webinar and link-shortening services before presenting copied event and login screens. Familiar branding at one stage does not authenticate the next destination.<\/p>\n Anthropic, Google, Microsoft, and the other named platforms are being impersonated or misused. The research does not establish that their own systems were breached.<\/p>\n A private event can feel relevant without seeming urgent. An employee considering AI tools might believe registration is a sensible part of keeping up with their work.<\/p>\n The promised access also supplies a reason to use a work account. A request that would seem intrusive on an unrelated website can feel routine during event registration.<\/p>\n That expectation deserves a pause. An invitation does not establish that an account provider is receiving your password, even when its button appears on the page.<\/p>\n The illustration above is a fictional event screen. It demonstrates the registration choice rather than serving as a captured invitation or proof of a real Anthropic event.<\/p>\n A convincing design is easy to copy. What matters is whether the event exists, who invited you, and which site actually receives the next piece of information.<\/p>\n Think of each transition as a new decision. A message delivered through a recognizable platform can still contain a link chosen by someone running a fraudulent event.<\/p>\n The documented email appears to use GoTo Webinar and its customer care address. A small sender-name error reads \u201cAustin from nthropic,\u201d missing the initial letter.<\/p>\n A shortened link then moves the reader toward the event. That delivery method can make the invitation look less unusual than a plainly unrelated sender and address.<\/p>\n Check the claimed host separately before opening registration. A legitimate webinar service can carry content created by someone who is not authorized to represent the advertised company.<\/p>\n The chain passes a Cloudflare Turnstile check and reaches a Zoom-style registration page. That change from the invitation\u2019s webinar branding is a useful inconsistency.<\/p>\n A security-looking checkpoint is not an endorsement of the page behind it. Completing a human verification test does not verify the organizer\u2019s identity.<\/p>\n Do not keep advancing just because a challenge worked normally. The browser can display a familiar test while the destination still belongs to an attacker.<\/p>\n The imitation event offers Google and Microsoft options, followed by a sliding CAPTCHA. The next screen copies the selected account provider.<\/p>\n This is the point to inspect the full destination. A button\u2019s label describes what it claims to do; it does not prove where its form sends information.<\/p>\n You do not need to solve either challenge to check the event safely. Leave and find the organizer through an independent company or contact route.<\/p>\n Cofense found username collection on the Google branch and username plus password capture on the Microsoft branch. Neither produced a normal completion redirect in the documented flow.<\/p>\n That distinction matters for recovery. Entering an email address is not the same exposure as submitting a password, approving authentication, or authorizing an application.<\/p>\n A stalled form does not show that your information stayed private. Do not test another account; report the submission and use the genuine provider for recovery.<\/p>\n The documented lookalikes include goo[.]gle-access-eventregister[.]icu and office[.]com-access-sharepoint[.]com. They are disabled here and should not be visited.<\/p>\n The recognizable words are arranged to suggest familiar account providers. Reading only the first few characters can leave a different impression from reading the complete hostname.<\/p>\n For the first address, gle-access-eventregister[.]icu is the registered domain. Splitting \u201cgoogle\u201d across address components does not turn it into Google\u2019s account service.<\/p>\n The second likewise does not become Microsoft\u2019s office.com because its beginning resembles that name. Its underlying registered domain is com-access-sharepoint[.]com.<\/p>\n These examples are useful for understanding the trick, but memorizing them is insufficient. Attackers can replace a domain while keeping the same registration story.<\/p>\n Open a service from a trusted bookmark or its official starting page when checking your account. Do not rely on a search advertisement offering urgent account recovery.<\/p>\n If an organization uses a company sign-in portal, ask IT which route is expected. A familiar logo is weaker evidence than a known authentication process.<\/p>\n People encounter human verification checks on genuine websites. Seeing one can therefore make an unfamiliar page feel like part of a normal online service.<\/p>\n Its purpose is different from verifying the organization making an offer. Passing it does not show that Anthropic approved the event or that Microsoft receives the password.<\/p>\n Checks can also make automated inspection harder. That does not mean every email filter is defeated or that every visitor who passes the test loses an account.<\/p>\n Keep using your organization\u2019s security controls. Report the invitation so defenders can inspect the message and destination through the tools available to them.<\/p>\n There is no benefit in testing the page with invented credentials from your work browser. You may expose information or encourage further interaction without establishing a safe result.<\/p>\n An address can support more targeted approaches, but it does not by itself establish that the attacker has your password or an authenticated session.<\/p>\n Report the interaction and watch for related login prompts or follow-up invitations. Do not claim a full account takeover unless there is evidence of access.<\/p>\n The documented Google branch was limited to usernames. If your experience included additional fields or permissions, report those details rather than assuming it matched that version.<\/p>\n Treat it as exposed even if no confirmation appeared. A stalled page does not demonstrate that the form failed to send what you typed.<\/p>\nSeveral familiar services appear along the way<\/h3>\n
The details worth checking before registration<\/h3>\n
\n
Why a Preview Invitation Can Catch a Busy Employee<\/h2>\n
How the Fake Anthropic AI Preview Scam Works<\/h2>\n
Step 1: A webinar invitation introduces the preview<\/h3>\n
Step 2: A checkpoint leads to a different event design<\/h3>\n
Step 3: Account buttons turn registration into a login request<\/h3>\n
Step 4: The two observed login branches collect different information<\/h3>\n
Read the Address Before Trusting the Login Screen<\/h2>\n
What a CAPTCHA Does Not Prove<\/h2>\n
What to Do if You Have Fallen Victim to This Scam<\/h2>\n
\n
If you entered only your email address<\/h3>\n
If you submitted a Microsoft password<\/h3>\n