Fake Anthropic Preview Invites Use GoTo Webinar to Steal Enterprise Credentials

The risk in this phishing campaign is built into its familiarity: an invitation that looks like a routine webinar, promises access to a private Anthropic preview, and routes employees through services they may recognize. Cofense researchers found that the campaign uses this chain to steal Google and Microsoft login details. For enterprises assessing AI access and account security, the practical lesson is that a trusted brand or a CAPTCHA can’t establish that a login page is legitimate.

The lure also reflects a real workplace pressure. Companies are working out how to use AI, and employees may see an invitation to discuss frontier models as a valuable professional opportunity. Frank Dickson of Dickson Research said the campaign trades on exclusivity and fear of missing out. “The attackers did not pick Anthropic at random,” he said. They chose a name attracting attention; another high-profile company could fill the role next month.

A familiar webinar wrapper conceals the destination

The initial message borrows GoTo Webinar branding, a choice that can help it pass routine email defenses. Cofense says the platform’s invitation emails are widely used and often aren’t blocked by security tools. The email appears to come from a legitimate sender, then directs recipients who try to register for the supposed event to a compromised URL.

Its pitch describes a private, invitation-only session for a select group, focused on AI systems, research, and frontier models. The wording gives the email a plausible business purpose while suggesting recipients have been chosen for access. A shortened link helps obscure the destination from email security tools. The researchers also found subdomains and hyphens used to make the malicious URL harder to recognize at a glance.

The link appears to have been generated by Zapier, a real service whose tools work with Claude, ChatGPT, and other systems compatible with Model Context Protocol (MCP). That association can make the invitation seem more credible, but the presence of a known service doesn’t verify where a link ultimately leads.

Other details don’t line up. The sender address appears as customercare@gotowebinar[.]com, while GoTo Webinar’s website is www.goto.com. The email uses GoTo Webinar branding, but the sender name is “Austin from nthropic,” omitting the “A” from Anthropic. The message has no obvious spelling errors, which makes that small inconsistency a useful clue.

CAPTCHAs add friction for security analysis

Clicking the phishing link first brings up a Cloudflare CAPTCHA. After a recipient completes it, the site presents a page that imitates a Zoom invitation. To attend the supposed event, the recipient is asked to register with a work email address and then choose “Continue with Google” or “Continue with Microsoft.” A second CAPTCHA appears along the way.

The researchers say the CAPTCHA pages appear to block analysis from VPN services, scanners, Tor browsers, and other security tools. Having two separate challenges may also make it harder for automated systems to follow the complete route. To a person, though, CAPTCHA prompts are common on legitimate websites and may lend the process a misleading air of normality.

That reversal is central to the trick. Dickson observed that CAPTCHAs are intended to keep bots out, but here they help keep security scanners away while allowing the targeted employee through. The pages don’t validate the event or the sign-in request; they add checkpoints that make inspection more difficult.

The final credential prompts imitate Google and Microsoft. The fake Google page collects usernames but, according to the researchers, doesn’t capture passwords. They suspect that gap is a configuration error. The Microsoft imitation collects both usernames and passwords, making that route capable of capturing a complete sign-in.

Both pages look remarkably similar to their real counterparts, and their domains are designed to pass a quick visual scan. The fake Google address is goo[.]gle-access-eventregister[.]icu. The Microsoft imitation uses office[.]com-access-sharepoint[.]com, a construction that borrows familiar Office and SharePoint terms while placing them in a misleading domain.

Neither page confirms a successful login or redirects to the real service after credentials are entered. By then, the researchers explain, the attackers have already received the submitted information. Stolen credentials could let them enter an account, reach its sensitive documents, or use it as an initial foothold for further access inside an organization.

Brand changes and domain details matter

Cofense recommends checking whether a message’s branding stays consistent from the email through the meeting page and sign-in. This campaign moves from GoTo Webinar to a Zoom-style page and then to a Google or Microsoft login. Those changes are easier to spot when recipients consider the full sequence instead of assessing each screen on its own.

Employees should also inspect the actual domain before entering credentials. A familiar logo, a convincing layout, or a brand name embedded in a long address doesn’t prove that a page belongs to the service it imitates. The researchers warn that threat actors can reproduce legitimate designs, including with the help of AI. A small typo, such as “nthropic,” can expose a fake, but organizations shouldn’t depend on every employee catching every flaw.

The AI industry’s use of gated previews and waitlists adds context to the campaign. Those practices make invitations to exclusive product briefings familiar, which can increase the appeal of a fake one. Dickson’s advice is to start with the visible inconsistencies: the misspelled sender name, the GoTo Webinar email branding, the Zoom-like registration page, and the Google or Microsoft credential prompts. Across three clicks, the recipient encounters three different brands.

Account defenses should carry the burden

Employee awareness can help, but Dickson cautioned against making it the main control. Asking someone to scrutinize a complicated URL under time pressure is an unreliable way to protect an enterprise account. As he put it, “The employee should not be the last line of defense.” His point is that organizations decide how valuable a stolen password becomes by the protections they put around accounts.

Phishing-resistant multi-factor authentication, including passkeys, can make a stolen password less useful. Dickson’s recommendations also include verifying invitations to AI previews through a company account team or another known contact, treating changes in branding across the email, meeting page, and login as warning signs, and resetting credentials if an employee has entered them on a phishing page. The affected account’s activity should then be reviewed.

The campaign’s design shows why email reputation and familiar interfaces can’t carry the whole defense. Attackers combine a plausible business invitation, trusted platform branding, link obfuscation, CAPTCHA barriers, and convincing login screens. The useful response is to verify unusual invitations through a known channel and make account access resistant to passwords captured by a convincing imitation.