What jumped out to me is not that phishing exists — that part is painfully normal — but that this one apparently bothered to imitate the feel of a real Anthropic promotion instead of just slapping a logo on a fake login form. That’s the annoying part. A lot of bad phishing falls apart the moment you glance at the URL or the typography. This one, if Malwarebytes is right, is trying harder: real-looking footer links, fake five-star reviews, a counter, even a browser-in-browser login flow. That combination is exactly the sort of thing that catches people who are otherwise careful.
The trick here is also a little more interesting than the usual “enter your password” con. Claude sign-in already routes people through Google for a lot of accounts, so the scam doesn’t need some exotic custom credential harvest. It just has to get you onto a convincing Google login screen, and then the blast radius is huge because a compromised Google account is basically a skeleton key for a lot of people’s working life. Gmail, Docs, single-sign-on elsewhere — that’s the real prize. The Claude branding is just bait.
I’m a bit cautious about how much I’d read into the Russian code comments or the UK-registered company trail. Those details are suggestive, but they’re also the kind of half-clues that investigators find in messy infrastructure all the time. They may point somewhere real, or they may be noise. Malwarebytes seems careful about that, and that caution feels earned. I’d trust the practical advice more than the attribution game.
If you build anything around Claude, this is the part worth remembering: the scam works because it exploits normal user expectations, not because it uses sophisticated malware. A disabled Apple login option, a fake popup trapped inside the page, a password manager that doesn’t autofill — those are the tells I’d actually look for. Not because users will always notice them. They won’t. But because in a world full of polished fake SaaS pages, the old advice about “check the URL” is necessary and not nearly sufficient.
I’d probably test this by opening the page in a sandboxed browser and seeing whether the login UI behaves like a real external Google flow or a page-local imitation. That’s the kind of thing developers and security folks should be making muscle memory, because the bar for deception keeps getting lower while the polish keeps getting better.
Reference: New Phishing Attack Promises Claude Max, but Steals Your Google Credentials Instead - CNET
