Attackers are successfully bypassing brand-name email security products by slipping low-grade phishing emails, as revealed in a recent Anthropic impersonation campaign. Since September, an unknown threat actor has been sending out emails worldwide, masquerading as a giveaway of early access to Anthropic’s advanced artificial intelligence (AI) technology.
Related: 'Gheist' Exploits GitHub Tokens to Steal Cloud Secrets Attackers entice targets with exclusive invitations to "a private preview" of Anthropic's supposed "new social media AI tool." The emails claim this is a "private, invitation-only" experience. ## Cybersecurity Awareness Month Takeaways For Cybersecurity Chief Information Security Officer (CISO) Shane Barney, it's no surprise that threat actors are successfully bypassing perimeter email defenses, even with cookie cutter tactics, techniques, and procedures (TTPs).
"If an employee falls victim to a fake Anthropic lure and their Microsoft or Google credentials are compromised, strict least-privilege access policies, phishing-resistant multifactor authentication, and privileged access management are what stops the attacker from laterally moving, elevating privileges, and accessing sensitive data," he warns.
Lastly, he adds, "Utilizing a centralized password manager that validates domain URLs before autofilling credentials provides a critical last line of defense against lookalike domains used in this attack, neutralizing the threat at the point of interaction." In observance of Cybersecurity Awareness Month 2026, Malimban emphasizes the importance of recognizing and reporting phishing scams.
