Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials

Key facts

Detection coverage

As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2627 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake Claude Max Giveaway — Malvertising/Phishing Infrastructure Access

Detects outbound web/DNS activity to domains associated with the fake-Claude-Max-giveaway and sibling AI-brand-impersonation malvertising cluster (TL_OSINT_Scan community-corroborated sibling infrastructure, campaign 'Malvertising via fake Claude AI and Codex install pages', medium confidence), plus a generic lure-keyword heuristic ('claude' + 'max' + 'giveaway'/'free') for undisclosed look-alike domains hosting the same phishing-kit template. This is the initial-access trigger point before the browser-in-the-browser (BitB) overlay ever loads.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1204.001, T1583.001, T1583.008
• Data sources: web_proxy, dns, firewall_pan_threat, zscaler_netskope_web_logs
• Severity: high
• Confidence: medium

Splunk SPL

index=proxy (sourcetype=pan:threat OR sourcetype=stream:http OR sourcetype=zscaler:web OR sourcetype=netskope:web)
| eval domain=lower(coalesce(dest_hostname, dest))
| eval url_l=lower(url)
| eval is_known_domain=if(domain IN ("raster-80.com","leaf68.com","claude-macos-app.com","opalblueprint10.com","cli-stack.com","stride25.com","pine63.com","mfawke.com","pirloz.com","roszo.com","claude-tools.com","codex-desk.com","plume-compass.com"), 1, 0)
| eval is_lure_keyword=if(match(url_l, "(?i)claude.{0,3}max.{0,10}(giveaway|free|subscription)") OR match(url_l, "(?i)100.?million.?users"), 1, 0)
| where is_known_domain=1 OR is_lure_keyword=1
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls by src_ip user domain
| where count > 0

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("raster-80.com","leaf68.com","claude-macos-app.com","opalblueprint10.com","cli-stack.com","stride25.com","pine63.com","mfawke.com","pirloz.com","roszo.com","claude-tools.com","codex-desk.com","plume-compass.com")
   or RemoteUrl matches regex @"(?i)claude.{0,3}max.{0,10}(giveaway|free|subscription)"
   or RemoteUrl matches regex @"(?i)100.?million.?users"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemoteIPType
| extend AlertReason = "Access to fake Claude Max giveaway / AI-brand malvertising infrastructure"

Sigma

title: Access to Fake Claude Max Giveaway or AI-Brand Malvertising Infrastructure
id: 7d3a1e2c-4b6f-4a9d-9c2e-8f1b0a6d5c11
status: experimental
description: Detects HTTP/DNS activity to domains linked to the fake Claude Max giveaway BitB phishing campaign and its TL_OSINT_Scan community-corroborated sibling malvertising cluster impersonating Claude/Codex install pages.
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-claude-max-giveaway-hides-a-google-account-phishing-trap
  - https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/
author: Threadlinqs Team
date: 2026-09-23
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1204.001
  - attack.resource-development
  - attack.t1583.001
  - attack.t1583.008
  - attack.tool.bitb
logsource:
  category: proxy
detection:
  selection_domain:
    c-uri|contains:
      - 'raster-80.com'
      - 'leaf68.com'
      - 'claude-macos-app.com'
      - 'opalblueprint10.com'
      - 'cli-stack.com'
      - 'stride25.com'
      - 'pine63.com'
      - 'mfawke.com'
      - 'pirloz.com'
      - 'roszo.com'
      - 'claude-tools.com'
      - 'codex-desk.com'
      - 'plume-compass.com'
  selection_lure:
    c-uri|contains|all:
      - 'claude'
      - 'max'
  condition: 1 of selection_*
fields:
  - c-ip
  - cs-username
  - c-uri
  - r-dns
falsepositives:
  - Legitimate pages that coincidentally contain both substrings 'claude' and 'max'
  - Security researchers or takedown vendors crawling the listed domains
level: high

Known false positives:

• Legitimate visits to unrelated sites that happen to share the substrings 'claude' and 'max' in the URL path
• Security researchers, sandboxes, or threat-intel crawlers deliberately visiting the listed domains for analysis

Tuning notes: The explicit domain list is TL_OSINT_Scan community-corroborated sibling infrastructure (campaign: 'Malvertising via fake Claude AI and Codex install pages', medium confidence, tweetfeed) — treat domain hits as high-confidence but refresh the list on every OSINT re-scan since malvertising infrastructure rotates quickly. The keyword heuristic will catch the undisclosed giveaway-page domain(s) but needs a suppression list for legitimate Anthropic/Claude marketing pages before enabling block mode.

• 🔒 Fake Claude Max Giveaway — Malvertising/Phishing Infrastructure Access · unlock with TL Creds
• 🔒 Browser-in-the-Browser (BitB) Fake Google Sign-In — Credential POST to Non-Google Domain · unlock with TL Creds
• 🔒 Post-Phishing Account Takeover — Google Login + Downstream Mail/Drive Access Within 1 Hour of Lure Exposure · unlock with TL Creds
• 🔒 Fake Claude Max Giveaway — Malvertising/Phishing Infrastructure Access · unlock with TL Creds
• 🔒 Browser-in-the-Browser (BitB) Fake Google Sign-In — Credential POST to Non-Google Domain · unlock with TL Creds
• 🔒 Post-Phishing Account Takeover — Google Login + Downstream Mail/Drive Access Within 1 Hour of Lure Exposure · unlock with TL Creds
• 🔒 Browser-in-the-Browser (BitB) Fake Google Sign-In — Credential POST to Non-Google Domain · unlock with TL Creds
• 🔒 Post-Phishing Account Takeover — Google Login + Downstream Mail/Drive Access Within 1 Hour of Lure Exposure · unlock with TL Creds

Indicators of compromise

As of 2026-09-23, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-2627.

Technical analysis

Malwarebytes researcher Stefan Dasic disclosed on September 23, 2026 a phishing campaign that impersonates Anthropic and its Claude Max subscription tier. The lure page claims Anthropic has surpassed 100 million users and is giving away 10,000 free one-month Claude Max subscriptions, requiring 'no payment details,' which increases perceived credibility. A countdown display shows fewer than 750-760 of 10,000 slots remaining and decreases every few seconds; the counter is generated client-side in the visitor's browser and resets on every page reload, so every visitor sees an identical, fabricated shortage with no relationship to real inventory.

Clicking the page's Google sign-in button does not open a genuine browser popup. Instead the page renders a fake browser window inside the current tab using HTML/CSS (and, per the underlying technique class, an iframe pointing at the attacker's credential-capture page) - complete with a spoofed address bar, a padlock icon, and a correctly spelled Google sign-in URL. The fake window is draggable, closely mimicking real OS-level popup behavior, but it cannot be dragged past the edge of the hosting webpage - the tell that distinguishes it from a genuine popup and Malwarebytes' recommended user-side detection test. This browser-in-the-browser (BitB) technique was first publicly documented by security researcher mr.d0x in March 2022 and has since been reused in numerous phishing kits.

The flow is engineered to funnel every visitor toward Google credential capture specifically: the Apple sign-in button reports itself as temporarily unavailable, and the email-address input field silently discards typed input and redirects the user into the fake Google flow regardless of what is entered. The BitB sequence opens with a bogus 'human verification' step before any password field appears, a dark-pattern UI element intended to add legitimacy. Malwarebytes also noted the phishing kit pre-fetches color values so its dark-themed fake window renders without a white flash during load, and that source-code comments are written in Russian and refer to the target using victim terminology - both indicators of a maintained, reusable phishing-kit product rather than a one-off page. The overlay itself loads through a single line of code pulled from an outside/third-party service, presented as a reusable sign-in widget, consistent with a BitB-phishing-kit-as-a-service model.

A stolen Google password grants the attacker access to the victim's email, documents, and the password-reset messages of other linked accounts, enabling downstream account-takeover chains. Malwarebytes specifically noted that if a victim uses 'Sign in with Google' for Claude itself, the stolen credential could also grant access to the victim's Claude account - valuable to attackers in its own right because paid Claude usage allowances cost money to replenish. Neither primary source disclosed the phishing domain(s), IP addresses, or file hashes used in this specific campaign, and the exact initial-distribution vector (malvertising, SEO-poisoned search results, or social-media promotion) was not confirmed, though Malwarebytes' guidance to 'avoid clicking promotional links' points toward an ad- or promo-link-driven lure consistent with the broader trend Microsoft documented in June 2026 of malvertising- and SEO-driven campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek. This campaign is mechanically distinct from - but thematically related to - two other 2026 AI-brand threats: an April 2026 Microsoft-tracked Claude/Anthropic-impersonation email campaign using a fraudulent 'Appeal Request' PDF and adversary-in-the-middle infrastructure, and an August-September 2026 wave of infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) hijacking already-authenticated Claude browser sessions to drain paid usage - both underscore that compromised Claude/Google access is being actively monetized by multiple, independent threat clusters.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Credential Access

T1056.003 Web Portal Capture

Initial Access

T1078 Valid Accounts; T1566 Phishing

Collection

T1114.002 Remote Email Collection; T1213 Data from Information Repositories

Execution

T1204.001 Malicious Link

Resource Development

T1583.001 Domains; T1583.008 Malvertising; T1586.002 Email Accounts; T1608.001 Upload Malware

Remediation

Immediate actions

• Do not click the sign-in button on unsolicited 'giveaway' or promotional pages claiming to offer free AI-service subscriptions; navigate directly to the official site (claude.ai / anthropic.com) instead of following the promoted link.
• Treat any in-page sign-in window as suspect until tested - attempt to drag it outside the boundaries of the hosting webpage before entering any credentials.
• If Google credentials were already entered on a suspected fake sign-in prompt, immediately change the Google account password, review recent account activity and connected third-party app/OAuth access, and revoke active sessions.

Workarounds

• Drag-test any in-page sign-in popup toward the edge of the browser window - if it cannot leave the page's content area, it is not a genuine OS-level popup.
• Treat countdown/scarcity timers on subscription-giveaway pages as decorative; they are client-side generated and unrelated to real inventory.
• Rely on a password manager that only autofills on the real, legitimate domain - it will stay silent on a fake in-page overlay because the overlay is not the genuine Google origin.

Longer-term hardening

• Deploy browser-based anti-phishing/URL-reputation extensions (e.g. Malwarebytes Browser Guard or an equivalent enterprise browser-isolation/anti-phishing control) to block known phishing domains before the page loads.
• Enforce phishing-resistant MFA (FIDO2/WebAuthn hardware security keys) on Google Workspace and any SSO-linked accounts so a captured password alone cannot complete authentication.
• Run user-awareness training that specifically covers browser-in-the-browser UI spoofing, since it defeats the traditional 'check the address bar' guidance by faking the address bar itself.

Affected and fixed versions

• N/A (social-engineering / UI-spoofing technique, not a software vulnerability) — Any user authenticating via an embedded or third-party 'Sign in with Google' prompt in a web browser
  Vulnerable versions: All browsers and versions - the technique exploits UI trust cues rather than a software flaw
  Fixed in: N/A - mitigated by user vigilance (drag-test), phishing-resistant MFA, and browser anti-phishing tooling, not by a vendor patch

Timeline

• 2022-03-15 Security researcher mr.d0x publicly documents the browser-in-the-browser (BitB) phishing technique, the UI-spoofing method later reused to build the fake Google sign-in overlay in this Claude Max giveaway campaign.
• 2026-04-20 Microsoft observes a separate Anthropic/Claude-impersonating email campaign (fake 'Claude Appeal Request' PDF lure) running April 20-22, 2026 that funnels victims to an adversary-in-the-middle Microsoft sign-in page - a different delivery chain from this BitB giveaway but part of the same AI-brand-impersonation trend.
• 2026-06-08 Microsoft publishes 'AI brands as bait,' documenting a broader wave of phishing, malvertising, and SEO-driven campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek to steal credentials and deliver malware.
• 2026-06-10 Palo Alto Networks Unit 42 documents a separate browser-in-the-browser campaign using fake, draggable Microsoft 365 login popups (with console-override and bot-redirect evasion) to steal Microsoft credentials - the same BitB technique class applied against a different impersonated brand.
• 2026-08-31 Anthropic and Malwarebytes disclose that infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) is separately hijacking already-authenticated Claude browser sessions to drain paid usage allowances - a mechanically distinct but related threat that reinforces that compromised Claude/Google access is actively monetized.
• 2026-09-23 Help Net Security publishes coverage summarizing the Malwarebytes findings, amplifying public awareness of the campaign.
• 2026-09-23 Malwarebytes researcher Stefan Dasic identifies and publishes analysis of the fake Claude Max giveaway site that uses a browser-in-the-browser Google sign-in overlay to harvest credentials.

Sources cited

• Fake Claude Max giveaway hides a Google account phishing trap malwarebytes.com · Vendor report · 2026-09-23
• AI brands as bait: How threat actors are using the AI hype in social engineering Microsoft · Vendor report · 2026-06-08
• Infostealers are hijacking Claude accounts at users' expense malwarebytes.com · Vendor report · 2026-09-09
• mrd0x/BITB - Browser In The Browser (BITB) Templates GitHub · Code repository · 2022-03-15
• Fake Claude Max giveaway tricks users into handing over their Google account credentials Help Net Security · News · 2026-09-23
• New Browser-in-the-Browser phishing uses fake login popups to steal Microsoft 365 credentials Help Net Security · News · 2026-06-10
• New Browser-in-the-Browser (BITB) Attack Makes Phishing Nearly Undetectable The Hacker News · News · 2022-03-15
• Anthropic locks out Claude users after infostealers hijack login sessions Help Net Security · News · 2026-08-31

More in phishing

• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
• BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)

Previous and next in phishing

• Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip Android APK + Certum-Signed ITD_Tax_Notice.exe Loader), Cloned e-Filing Portals and Refund Scams Next report