{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zapier-url-shortener/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Google Workspace","Microsoft 365","GoTo Webinar","Zapier URL Shortener","Cloudflare CAPTCHA"],"_cs_severities":["high"],"_cs_tags":["phishing","credential-harvesting","social-engineering","cloud"],"_cs_type":"advisory","_cs_vendors":["Google","Microsoft","GoTo","Zapier","Cloudflare"],"content_html":"\u003cp\u003eA credential phishing campaign identified by Cofense targets organizations with invitations to a fraudulent \u0026quot;Anthropic AI\u0026quot; private preview. The campaign successfully bypasses standard email security by abusing trusted platforms including GoTo Webinar, Zapier, and Cloudflare. The infrastructure utilizes multiple CAPTCHA challenges to impede automated sandbox analysis and credential harvesting pages designed to impersonate Google and Microsoft authentication portals.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial outreach via an email appearing to come from GoTo Webinar claiming to offer an exclusive Anthropic AI preview.\u003c/li\u003e\n\u003cli\u003eThe email contains a link shortened through a legitimate service (Zapier) to evade email filtering.\u003c/li\u003e\n\u003cli\u003eClicking the link triggers a Cloudflare CAPTCHA to verify the visitor.\u003c/li\u003e\n\u003cli\u003eThe victim is redirected to a spoofed Zoom-branded meeting registration page.\u003c/li\u003e\n\u003cli\u003eThe victim interacts with the registration form and selects \u0026quot;Continue with Google\u0026quot; or \u0026quot;Continue with Microsoft\u0026quot;.\u003c/li\u003e\n\u003cli\u003eA custom CAPTCHA slider appears to block automated scanners and VPN traffic.\u003c/li\u003e\n\u003cli\u003eA spoofed credential harvesting page captures the user email or login information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful phishing leads to the compromise of corporate identity credentials, allowing attackers to access sensitive documentation or use the account for further internal infiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock the identified malicious domains at the web proxy and DNS levels.\u003c/li\u003e\n\u003cli\u003eImplement email authentication controls (DMARC/SPF/DKIM) to protect your domain and improve visibility into spoofed sender activity.\u003c/li\u003e\n\u003cli\u003eAdvise employees to manually inspect URL domains for mismatches rather than relying on the branding present in the email or landing page.\u003c/li\u003e\n\u003cli\u003eEvaluate web filtering solutions that allow for browser isolation or manual analysis of sites that employ multi-stage CAPTCHA redirects.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T15:52:40Z","date_published":"2026-10-29T15:52:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-anthropic-phishing/","summary":"Since September 2026, threat actors have leveraged fake Anthropic AI preview invitations, abused legitimate services, and utilized multi-layer CAPTCHA bypasses to harvest Google and Microsoft credentials.","title":"Credential phishing campaign abusing AI themes and CAPTCHA evasion","url":"https://feed.craftedsignal.io/briefs/2026-10-anthropic-phishing/"}],"language":"en","title":"CraftedSignal Threat Feed - Zapier URL Shortener","version":"https://jsonfeed.org/version/1.1"}