Mass Phishing/Fraud Campaign Impersonating Anthropic Claude and Mythos Brands (3,188 Malicious Domains)

Mass Phishing/Fraud Campaign Impersonating Anthropic Claude (TL-2026-1521), also tracked as Anthropic Mythos Phishing Campaign, is a high-severity phishing campaign, first published 2026-07-19. It has no confirmed attribution, affects Anthropic Claude / Claude Code / Claude Desktop / Claude Pro (brand, maps to 38 MITRE ATT&CK techniques (T1005, T1027.002, T1036.005), and is covered by 9 detection rules and 48 indicators of compromise.

Key facts for TL-2026-1521

Threat ID
TL-2026-1521
Also known as
Anthropic Mythos Phishing Campaign, Operation Fake Claude Code, ACRStealer Claude Code Impersonation Campaign
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-07-19
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, softwaredevelopment, cybersecurity, finance, cryptocurrency, generalconsumer
Target regions
Global
Detection rules
9
Indicators of compromise
48

Malware and tooling in Mass Phishing/Fraud Campaign Impersonating Anthropic Claude

Malware and tooling: ACR Stealer, EclecticIQ Fileless PowerShell Infostealer, BSC smart contract 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468

BforeAI PreCrime Labs identified 3,188 malicious domains registered between April 1 and May 15, 2026 that impersonate Anthropic's Claude and Mythos brands, spanning fake AI security-scanner platforms, Claude Pro/OAuth credential-harvesting login pages, trojanized CLI tools and browser extensions distributing infostealers and RATs, underground account-resale marketplaces, and monetization/narrative-manipulation scam sites.

How Mass Phishing/Fraud Campaign Impersonating Anthropic Claude works

In the six weeks following Anthropic's Mythos announcement, BforeAI's PreCrime Labs tracked 3,188 domains registered (April 1 - May 15, 2026) engineered to exploit trust in the Claude and Mythos brands. Domains cluster into naming patterns: pure Mythos branding (~500 domains, e.g. mythosaiapp, mythosauth, mythosbench, mythosrouter, mythosproxy) impersonating AI agents, evaluation dashboards, and infrastructure components; Claude-Mythos hybrids (~96 domains, e.g. claudemythospreview, freeclaudemythos) suggesting fake early-access programs or 'Pro unlocks'; Claude-only strings (~2,300 domains, e.g. 10xclaude, 1claude) exploiting the Claude brand directly; and security-themed variants (mythoscyber, mythosprotector, mythosforensics, mythosvulnerabilityscanner) that disguise phishing infrastructure with legitimate cybersecurity language. Registrations span commercial TLDs (.com, .net, .org, .io), tech-aligned TLDs (.ai, .app, .cloud, .tech, .digital), and abuse-prone/novelty TLDs (.xyz, .top, .click, .cfd, .icu, .vip, .space), concentrated at mass-market bulk registrars with WHOIS privacy enabled and registration bursts timed to media cycles.

The campaign spans seven operational categories: (1) fake AI security platforms such as mythos-ai[.]net impersonating 'Mythos by Anthropic' as an enterprise vulnerability-scanning SaaS that solicits infrastructure URLs, API tokens, and repository details via 'request access' workflows without any active intrusion; (2) OAuth/credential-harvesting dashboards branded 'Claude Pro,' 'Claude Research Workspace,' or 'Claude Mythos Agents'; (3) trojanized tool distribution via installers posing as 'Claude Desktop,' 'Claude CLI,' 'Claude Browser Extension,' or 'Claude Security Agent' that deliver infostealers and RATs; (4) account-resale marketplaces (claudekyc[.]shop, claudecode-buy[.]com) advertising unauthorized Claude/ChatGPT accounts with KYC-bypass claims and Telegram-based after-sales support; (5) fake monetization schemes (earnwithclaude[.]com) exploiting 'make money with AI' narratives to harvest leads or funnel victims into subscription scams; (6) narrative-manipulation/whistleblower-style sites such as bannedbyanthropic[.]com posing as a transparency portal documenting fictitious Anthropic bans to harvest identities from frustrated users; and (7) gambling/account-resale ecosystems leveraging Mythos branding for fraudulent gaming platforms with fake top-up mechanics.

The trojanized-tool-distribution category converges with a broader, actively-tracked ecosystem of AI-developer-tool impersonation campaigns documented independently by Straiker and EclecticIQ in 2026. Straiker's investigation ('Fake Claude Code, Real Malware') identified 88 phishing domains (32 active as of May 14, 2026) impersonating Claude Code, NotebookLM, JetBrains, and other AI developer tools, serving weaponized install commands that use shell operators (e.g. '&') to silently background-execute malicious payloads while a legitimate-looking foreground operation completes. The chain deploys a heavily-obfuscated Go binary (compiled with garble) named ServiceCore.dll implementing a full ML-KEM-768 (Kyber) post-quantum key-encapsulation pipeline to protect a 192,015-byte shellcode payload, which loads ACRStealer (also tracked as the Amatera variant; first documented by AhnLab ASEC in February 2025) entirely in memory. ACRStealer exfiltrates browser data, 65+ browser credential stores, 175+ cryptocurrency wallet extensions, and — notably — AI-coding-assistant credentials from Cline (.cline/data/secrets.json) and Continue.dev (.continue/config.yaml), plus Snowflake SSH session tokens. Persistence is established via a scheduled task masquerading as 'Microsoft Edge Update' (MicrosoftEdgeUpdateCore.dll, rundll32 export GetTranslateScript), installed at %LocalAppData%\Microsoft\EdgeUpdate\, guarded by a per-host mutex and a TLS-callback execution trick that runs code during DLL_PROCESS_ATTACH before the host process finishes loading. A companion Rust-compiled cryptocurrency clipper (1.exe) silently swaps clipboard wallet addresses across Bitcoin (legacy/SegWit/Taproot), Ethereum, Tron, XRP, Cosmos, Monero, and Algorand, using hardcoded fallback addresses before C2 contact succeeds. C2 channels include a primary IP retrieved via a Telegram dead-drop mechanism (message parsed from telegrap[.]ph using base64-encoded IP between markers), a rotating-subdomain WebDAV C2, an ACRStealer-specific C2 domain, and a Binance Smart Chain smart-contract address used for blockchain-based C2/dead-drop resilience. The whole campaign carries a consistent detection GUID (f1575b64-8492-4e8b-b102-4d26e8c70371) across variants.

EclecticIQ independently tracked a parallel SEO-poisoning campaign (identified March 2026) that ranks typosquatted Gemini CLI / Claude Code installation pages above official documentation in search results. Victims are lured into pasting a single PowerShell one-liner that uses Invoke-RestMethod piped to Invoke-Expression (irm|iex) to simultaneously install the legitimate tool (masking the compromise) and silently download a fileless, in-memory PowerShell infostealer. The stealer patches PSEtwLogProvider to disable ETW, performs an AMSI bypass, includes ~6,800 lines of obfuscation, and checks for qemu-ga strings to detect and evade sandboxes before harvesting credentials from 30+ applications (Chrome, Edge, Firefox, Slack, Teams, Discord, WinSCP, PuTTY, VPN clients, cloud storage, and cryptocurrency wallets). C2 is HTTPS-based with distinct task-dispatch endpoints (/take, /process, /validate) enabling arbitrary remote PowerShell execution. Passive-DNS pivoting from a claude-code impersonation domain hosted on Netherlands-based MIRhosting surfaced 30+ related domains also impersonating Node.js, Chocolatey, KeePassXC, and Monero tooling, indicating a multi-stage developer-targeting infrastructure cluster reachable from the same registration/hosting patterns as the core BforeAI-tracked domain set.

Taken together, this threat represents a coordinated, brand-timed social-engineering campaign that exploits the Claude/Mythos launch news cycle to run parallel phishing, credential-harvesting, malware-distribution, and fraud/monetization tracks against developers, security teams, and general AI-curious users — a shift toward intelligence-driven social engineering in which victims voluntarily disclose sensitive infrastructure and credential data without requiring active intrusion.

MITRE ATT&CK techniques used in TL-2026-1521

Collection

T1005 Data from Local System; T1115 Clipboard Data; T1560 Archive Collected Data

Defense Evasion

T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1546.016 Installer Packages

Privilege Escalation

T1055 Process Injection; T1134.003 Make and Impersonate Token; T1134.005 SID-History Injection

Execution

T1059.001 PowerShell; T1106 Native API; T1204.001 Malicious Link

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography

Discovery

T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion

Initial Access

T1189 Drive-by Compromise; T1566.002 Spearphishing Link

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1583.008 Malvertising; T1584.006 Web Services; T1585.001 Social Media Accounts; T1587.001 Malware

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1686 Disable or Modify System Firewall

Affected products and versions in Mass Phishing/Fraud Campaign Impersonating Anthropic Claude

  • Anthropic — Claude / Claude Code / Claude Desktop / Claude Pro (brand, not vulnerable software)
    Vulnerable versions: N/A - brand impersonation, not a product vulnerability
  • Anthropic — Mythos platform (brand)
    Vulnerable versions: N/A - brand impersonation
  • Multiple — AI coding assistant credential stores (Cline, Continue.dev)
    Vulnerable versions: All versions storing plaintext secrets.json / config.yaml

Remediation for Mass Phishing/Fraud Campaign Impersonating Anthropic Claude

Immediate actions

  • Block/sinkhole known malicious domains and IPs listed in threat_iocs (mythos-ai[.]net, anthropicclaude[.]pw, claudemythos[.]icu, claude-code.co[.]com cluster, ACRStealer C2 set, EclecticIQ C2 set)
  • Alert on and quarantine installers or browser extensions claiming to be 'Claude Desktop', 'Claude CLI', 'Claude Mythos CLI', 'Claude Browser Extension', or 'Claude Security Agent' from non-official sources
  • Search email/proxy/DNS logs for the campaign GUID pattern and any of the listed domains; isolate any host that resolved them
  • Block PowerShell command patterns combining Invoke-RestMethod and Invoke-Expression ('irm | iex') and hidden-window PowerShell execution (-WindowStyle Hidden)
  • Revoke and rotate any Claude/Anthropic API tokens, Cline/.cline secrets.json, or Continue.dev config.yaml credentials on hosts suspected of exposure

Workarounds

  • Restrict installation of AI CLI/desktop tools to signed packages sourced only from official Anthropic/Google/JetBrains domains and package managers
  • Treat any 'Claude-' or 'Mythos-' branded domain outside Anthropic's known namespace as untrusted by default

Longer-term hardening

  • Centralize and whitelist known-good domains/URLs for AI developer tooling installs organization-wide
  • Deploy EDR rules for scheduled-task persistence masquerading as 'Microsoft Edge Update' and for rundll32 execution of GetTranslateScript exports
  • Apply brand-pattern domain risk scoring at registrar/DNS-monitoring level for 'claude'/'anthropic'/'mythos' combined with novelty TLDs or terms like pro/unlock/scanner/auth/identity/proxy
  • User awareness training on ClickFix-style 'paste this command into your terminal' social engineering and on fake AI security-scanner 'request access' forms
  • Monitor clipboard-hijacking behavior (cryptocurrency clipper) via EDR clipboard-monitoring telemetry

Weaknesses (CWE) in Mass Phishing/Fraud Campaign Impersonating Anthropic Claude

CWE-451, CWE-506, CWE-494, CWE-522

Timeline of Mass Phishing/Fraud Campaign Impersonating Anthropic Claude

  • AhnLab ASEC first documents the ACRStealer malware family (predecessor variant), later reused/enhanced in the Claude Code impersonation campaign.
  • EclecticIQ identifies an ongoing SEO-poisoning campaign impersonating Gemini CLI and Claude Code installation pages to deliver a fileless PowerShell infostealer.
  • Cyderes reports a malvertising campaign serving fake Claude Code installers that drop an infostealer via poisoned search ads.
  • BforeAI PreCrime Labs observes the beginning of a six-week domain registration burst (3,188 domains) impersonating Claude and Mythos branding.
  • Anthropic announces the Mythos platform, triggering a surge of opportunistic brand-impersonation domain registrations.
  • 7AI publishes 'Claude Fraud' research documenting weaponization of trusted AI developer tooling against the security community.
  • Trend Micro documents a related campaign abusing GitHub release payloads alongside Claude Code lures to distribute malware.
  • Straiker publishes analysis of 88 phishing domains (32 active) delivering ACRStealer via trojanized Claude Code/NotebookLM/JetBrains installers using ML-KEM-768-protected loaders.
  • BforeAI PreCrime Labs publishes 'Anthropic Mythos Phishing Domains: Threats Exploiting Claude,' detailing the full domain-impersonation campaign taxonomy and IOCs.
  • BforeAI's tracked domain-registration observation window for the 3,188-domain Mythos/Claude impersonation campaign closes.
  • TL-Intel-Harness ingests the BforeAI report via RSS hunt phase and opens threat record TL-2026-1521 for research.

Sources cited for Mass Phishing/Fraud Campaign Impersonating Anthropic Claude

Threats related to Mass Phishing/Fraud Campaign Impersonating Anthropic Claude

Detection coverage for TL-2026-1521

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1521 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1521

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats