Attack Chain

1. Initial outreach via an email appearing to come from GoTo Webinar claiming to offer an exclusive Anthropic AI preview.
2. The email contains a link shortened through a legitimate service (Zapier) to evade email filtering.
3. Clicking the link triggers a Cloudflare CAPTCHA to verify the visitor.
4. The victim is redirected to a spoofed Zoom-branded meeting registration page.
5. The victim interacts with the registration form and selects "Continue with Google" or "Continue with Microsoft".
6. A custom CAPTCHA slider appears to block automated scanners and VPN traffic.
7. A spoofed credential harvesting page captures the user email or login information.

Impact

Successful phishing leads to the compromise of corporate identity credentials, allowing attackers to access sensitive documentation or use the account for further internal infiltration.

Recommendation

• Block the identified malicious domains at the web proxy and DNS levels.
• Implement email authentication controls (DMARC/SPF/DKIM) to protect your domain and improve visibility into spoofed sender activity.
• Advise employees to manually inspect URL domains for mismatches rather than relying on the branding present in the email or landing page.
• Evaluate web filtering solutions that allow for browser isolation or manual analysis of sites that employ multi-stage CAPTCHA redirects.