Credential phishing campaign abusing AI themes and CAPTCHA evasion

A credential phishing campaign identified by Cofense targets organizations with invitations to a fraudulent "Anthropic AI" private preview. The campaign successfully bypasses standard email security by abusing trusted platforms including GoTo Webinar, Zapier, and Cloudflare. The infrastructure utilizes multiple CAPTCHA challenges to impede automated sandbox analysis and credential harvesting pages designed to impersonate Google and Microsoft authentication portals.

Attack Chain

1. Initial outreach via an email appearing to come from GoTo Webinar claiming to offer an exclusive Anthropic AI preview.
2. The email contains a link shortened through a legitimate service (Zapier) to evade email filtering.
3. Clicking the link triggers a Cloudflare CAPTCHA to verify the visitor.
4. The victim is redirected to a spoofed Zoom-branded meeting registration page.
5. The victim interacts with the registration form and selects "Continue with Google" or "Continue with Microsoft".
6. A custom CAPTCHA slider appears to block automated scanners and VPN traffic.
7. A spoofed credential harvesting page captures the user email or login information.

Impact

Successful phishing leads to the compromise of corporate identity credentials, allowing attackers to access sensitive documentation or use the account for further internal infiltration.

Recommendation

• Block the identified malicious domains at the web proxy and DNS levels.
• Implement email authentication controls (DMARC/SPF/DKIM) to protect your domain and improve visibility into spoofed sender activity.
• Advise employees to manually inspect URL domains for mismatches rather than relying on the branding present in the email or landing page.
• Evaluate web filtering solutions that allow for browser isolation or manual analysis of sites that employ multi-stage CAPTCHA redirects.