# Mass Phishing/Fraud Campaign Impersonating Anthropic Claude and Mythos Brands (3,188 Malicious Domains)

> BforeAI PreCrime Labs identified 3,188 malicious domains registered between April 1 and May 15, 2026 that impersonate Anthropic's Claude and Mythos brands, spanning fake AI security-scanner platforms, Claude Pro/OAuth credential-harvesting login pages, trojanized CLI tools and browser extensions distributing infostealers and RATs, underground account-resale marketplaces, and monetization/narrative-manipulation scam sites.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1521
- **ID:** TL-2026-1521
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In the six weeks following Anthropic's Mythos announcement, BforeAI's PreCrime Labs tracked 3,188 domains registered (April 1 - May 15, 2026) engineered to exploit trust in the Claude and Mythos brands. Domains cluster into naming patterns: pure Mythos branding (~500 domains, e.g. mythosaiapp, mythosauth, mythosbench, mythosrouter, mythosproxy) impersonating AI agents, evaluation dashboards, and infrastructure components; Claude-Mythos hybrids (~96 domains, e.g. claudemythospreview, freeclaudemythos) suggesting fake early-access programs or 'Pro unlocks'; Claude-only strings (~2,300 domains, e.g. 10xclaude, 1claude) exploiting the Claude brand directly; and security-themed variants (mythoscyber, mythosprotector, mythosforensics, mythosvulnerabilityscanner) that disguise phishing infrastructure with legitimate cybersecurity language. Registrations span commercial TLDs (.com, .net, .org, .io), tech-aligned TLDs (.ai, .app, .cloud, .tech, .digital), and abuse-prone/novelty TLDs (.xyz, .top, .click, .cfd, .icu, .vip, .space), concentrated at mass-market bulk registrars with WHOIS privacy enabled and registration bursts timed to media cycles.

The campaign spans seven operational categories: (1) fake AI security platforms such as mythos-ai[.]net impersonating 'Mythos by Anthropic' as an enterprise vulnerability-scanning SaaS that solicits infrastructure URLs, API tokens, and repository details via 'request access' workflows without any active intrusion; (2) OAuth/credential-harvesting dashboards branded 'Claude Pro,' 'Claude Research Workspace,' or 'Claude Mythos Agents'; (3) trojanized tool distribution via installers posing as 'Claude Desktop,' 'Claude CLI,' 'Claude Browser Extension,' or 'Claude Security Agent' that deliver infostealers and RATs; (4) account-resale marketplaces (claudekyc[.]shop, claudecode-buy[.]com) advertising unauthorized Claude/ChatGPT accounts with KYC-bypass claims and Telegram-based after-sales support; (5) fake monetization schemes (earnwithclaude[.]com) exploiting 'make money with AI' narratives to harvest leads or funnel victims into subscription scams; (6) narrative-manipulation/whistleblower-style sites such as bannedbyanthropic[.]com posing as a transparency portal documenting fictitious Anthropic bans to harvest identities from frustrated users; and (7) gambling/account-resale ecosystems leveraging Mythos branding for fraudulent gaming platforms with fake top-up mechanics.

The trojanized-tool-distribution category converges with a broader, actively-tracked ecosystem of AI-developer-tool impersonation campaigns documented independently by Straiker and EclecticIQ in 2026. Straiker's investigation ('Fake Claude Code, Real Malware') identified 88 phishing domains (32 active as of May 14, 2026) impersonating Claude Code, NotebookLM, JetBrains, and other AI developer tools, serving weaponized install commands that use shell operators (e.g. '&') to silently background-execute malicious payloads while a legitimate-looking foreground operation completes. The chain deploys a heavily-obfuscated Go binary (compiled with garble) named ServiceCore.dll implementing a full ML-KEM-768 (Kyber) post-quantum key-encapsulation pipeline to protect a 192,015-byte shellcode payload, which loads ACRStealer (also tracked as the Amatera variant; first documented by AhnLab ASEC in February 2025) entirely in memory. ACRStealer exfiltrates browser data, 65+ browser credential stores, 175+ cryptocurrency wallet extensions, and — notably — AI-coding-assistant credentials from Cline (.cline/data/secrets.json) and Continue.dev (.continue/config.yaml), plus Snowflake SSH session tokens. Persistence is established via a scheduled task masquerading as 'Microsoft Edge Update' (MicrosoftEdgeUpdateCore.dll, rundll32 export GetTranslateScript), installed at %LocalAppData%\Microsoft\EdgeUpdate\, guarded by a per-host mutex and a TLS-callback execution trick that runs code during DLL_PROCESS_ATTACH before the host process finishes loading. A companion Rust-compiled cryptocurrency clipper (1.exe) silently swaps clipboard wallet addresses across Bitcoin (legacy/SegWit/Taproot), Ethereum, Tron, XRP, Cosmos, Monero, and Algorand, using hardcoded fallback addresses before C2 contact succeeds. C2 channels include a primary IP retrieved via a Telegram dead-drop mechanism (message parsed from telegrap[.]ph using base64-encoded IP between markers), a rotating-subdomain WebDAV C2, an ACRStealer-specific C2 domain, and a Binance Smart Chain smart-contract address used for blockchain-based C2/dead-drop resilience. The whole campaign carries a consistent detection GUID (f1575b64-8492-4e8b-b102-4d26e8c70371) across variants.

EclecticIQ independently tracked a parallel SEO-poisoning campaign (identified March 2026) that ranks typosquatted Gemini CLI / Claude Code installation pages above official documentation in search results. Victims are lured into pasting a single PowerShell one-liner that uses Invoke-RestMethod piped to Invoke-Expression (irm|iex) to simultaneously install the legitimate tool (masking the compromise) and silently download a fileless, in-memory PowerShell infostealer. The stealer patches PSEtwLogProvider to disable ETW, performs an AMSI bypass, includes ~6,800 lines of obfuscation, and checks for qemu-ga strings to detect and evade sandboxes before harvesting credentials from 30+ applications (Chrome, Edge, Firefox, Slack, Teams, Discord, WinSCP, PuTTY, VPN clients, cloud storage, and cryptocurrency wallets). C2 is HTTPS-based with distinct task-dispatch endpoints (/take, /process, /validate) enabling arbitrary remote PowerShell execution. Passive-DNS pivoting from a claude-code impersonation domain hosted on Netherlands-based MIRhosting surfaced 30+ related domains also impersonating Node.js, Chocolatey, KeePassXC, and Monero tooling, indicating a multi-stage developer-targeting infrastructure cluster reachable from the same registration/hosting patterns as the core BforeAI-tracked domain set.

Taken together, this threat represents a coordinated, brand-timed social-engineering campaign that exploits the Claude/Mythos launch news cycle to run parallel phishing, credential-harvesting, malware-distribution, and fraud/monetization tracks against developers, security teams, and general AI-curious users — a shift toward intelligence-driven social engineering in which victims voluntarily disclose sensitive infrastructure and credential data without requiring active intrusion.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.001 Domains
- T1583.008 Malvertising
- T1587.001 Malware
- T1585.001 Social Media Accounts
- T1584.006 Web Services
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1059.001 PowerShell
- T1106 Native API
- T1053.005 Scheduled Task
- T1546.016 Installer Packages
- T1055 Process Injection
- T1134.003 Make and Impersonate Token
- T1134.005 SID-History Injection
- T1027.002 Software Packing
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1685.005 Clear Windows Event Logs
- T1686 Disable or Modify System Firewall
- T1620 Reflective Code Loading
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1497 Virtualization/Sandbox Evasion
- T1005 Data from Local System
- T1115 Clipboard Data
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1573.002 Asymmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Anthropic Mythos Phishing Domains: Threats Exploiting Claude](https://bfore.ai/report/anthropic-mythos-phishing-domains-threats-exploiting-claude/)
- [Fake Claude Code, Real Malware: Inside the Campaign Targeting AI Developers](https://www.straiker.ai/blog/acr-stealer-claude-code-impersonation-campaign)
- [SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer](https://blog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini-and-claude-code-impersonation-to-deliver-infostealer)
- [Fake Anthropic Sites Deliver Fileless Infostealer to Claude Code Users](https://hackread.com/fake-anthropic-sites-fileless-infostealer-claude-code-users/)
- [Fake Gemini and Claude Code Sites Spread Infostealers](https://www.infosecurity-magazine.com/news/gemini-claude-infostealers-seo/)
- [Operation Phantom Claude: A macOS Infostealer Anthropic Impersonation Campaign](https://falconfeeds.io/blogs/operation-phantom-claude-macos-infostealer-anthropic-impersonation-campaign/)
- [Claude Fraud - When Trusted Tools Become the Attack Surface](https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools)
- [Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads](https://www.trendmicro.com/en_us/research/26/d/weaponizing-trust-claude-code-lures-and-github-release-payloads.html)
- [Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer](https://www.cyderes.com/howler-cell/fake-claude-code-installer-infostealer)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1521