Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials

Fake Claude Max Giveaway Phishing Campaign Uses (TL-2026-2627) is a medium-severity phishing campaign, first published 2026-09-23. It has no confirmed attribution, affects N/A (social-engineering / UI-spoofing technique, not a software, maps to 11 MITRE ATT&CK techniques (T1036.005, T1056.003, T1078), and is covered by 9 detection rules and 6 indicators of compromise.

Key facts for TL-2026-2627

Threat ID
TL-2026-2627
Severity
MEDIUM
Status
ACTIVE
Category
PHISHING
First published
2026-09-23
Last reviewed
2026-09-23
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
consumer, general public, individual users, ai saas subscribers
Target regions
Global
Detection rules
9
Indicators of compromise
6

Malware and tooling in Fake Claude Max Giveaway Phishing Campaign Uses

Malware and tooling: Claude Max subscription (impersonated product used as lure), Malwarebytes Browser Guard, Malwarebytes Scam Guard

A phishing site impersonating Anthropic's Claude Max subscription lures victims with a fake giveaway of 10,000 free one-month subscriptions and a manufactured countdown timer, then uses a browser-in-the-browser (BitB) overlay - a fake but convincing Google sign-in window rendered inside the page - to steal victims' Google account credentials.

How Fake Claude Max Giveaway Phishing Campaign Uses works

Malwarebytes researcher Stefan Dasic disclosed on September 23, 2026 a phishing campaign that impersonates Anthropic and its Claude Max subscription tier. The lure page claims Anthropic has surpassed 100 million users and is giving away 10,000 free one-month Claude Max subscriptions, requiring 'no payment details,' which increases perceived credibility. A countdown display shows fewer than 750-760 of 10,000 slots remaining and decreases every few seconds; the counter is generated client-side in the visitor's browser and resets on every page reload, so every visitor sees an identical, fabricated shortage with no relationship to real inventory.

Clicking the page's Google sign-in button does not open a genuine browser popup. Instead the page renders a fake browser window inside the current tab using HTML/CSS (and, per the underlying technique class, an iframe pointing at the attacker's credential-capture page) - complete with a spoofed address bar, a padlock icon, and a correctly spelled Google sign-in URL. The fake window is draggable, closely mimicking real OS-level popup behavior, but it cannot be dragged past the edge of the hosting webpage - the tell that distinguishes it from a genuine popup and Malwarebytes' recommended user-side detection test. This browser-in-the-browser (BitB) technique was first publicly documented by security researcher mr.d0x in March 2022 and has since been reused in numerous phishing kits.

The flow is engineered to funnel every visitor toward Google credential capture specifically: the Apple sign-in button reports itself as temporarily unavailable, and the email-address input field silently discards typed input and redirects the user into the fake Google flow regardless of what is entered. The BitB sequence opens with a bogus 'human verification' step before any password field appears, a dark-pattern UI element intended to add legitimacy. Malwarebytes also noted the phishing kit pre-fetches color values so its dark-themed fake window renders without a white flash during load, and that source-code comments are written in Russian and refer to the target using victim terminology - both indicators of a maintained, reusable phishing-kit product rather than a one-off page. The overlay itself loads through a single line of code pulled from an outside/third-party service, presented as a reusable sign-in widget, consistent with a BitB-phishing-kit-as-a-service model.

A stolen Google password grants the attacker access to the victim's email, documents, and the password-reset messages of other linked accounts, enabling downstream account-takeover chains. Malwarebytes specifically noted that if a victim uses 'Sign in with Google' for Claude itself, the stolen credential could also grant access to the victim's Claude account - valuable to attackers in its own right because paid Claude usage allowances cost money to replenish. Neither primary source disclosed the phishing domain(s), IP addresses, or file hashes used in this specific campaign, and the exact initial-distribution vector (malvertising, SEO-poisoned search results, or social-media promotion) was not confirmed, though Malwarebytes' guidance to 'avoid clicking promotional links' points toward an ad- or promo-link-driven lure consistent with the broader trend Microsoft documented in June 2026 of malvertising- and SEO-driven campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek. This campaign is mechanically distinct from - but thematically related to - two other 2026 AI-brand threats: an April 2026 Microsoft-tracked Claude/Anthropic-impersonation email campaign using a fraudulent 'Appeal Request' PDF and adversary-in-the-middle infrastructure, and an August-September 2026 wave of infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) hijacking already-authenticated Claude browser sessions to drain paid usage - both underscore that compromised Claude/Google access is being actively monetized by multiple, independent threat clusters.

MITRE ATT&CK techniques used in TL-2026-2627

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Credential Access

T1056.003 Web Portal Capture

Initial Access

T1078 Valid Accounts; T1566 Phishing

Collection

T1114.002 Remote Email Collection; T1213 Data from Information Repositories

Execution

T1204.001 Malicious Link

Resource Development

T1583.001 Domains; T1583.008 Malvertising; T1586.002 Email Accounts; T1608.001 Upload Malware

Affected products and versions in Fake Claude Max Giveaway Phishing Campaign Uses

  • N/A (social-engineering / UI-spoofing technique, not a software vulnerability) — Any user authenticating via an embedded or third-party 'Sign in with Google' prompt in a web browser
    Vulnerable versions: All browsers and versions - the technique exploits UI trust cues rather than a software flaw
    Fixed in: N/A - mitigated by user vigilance (drag-test), phishing-resistant MFA, and browser anti-phishing tooling, not by a vendor patch

Remediation for Fake Claude Max Giveaway Phishing Campaign Uses

Immediate actions

  • Do not click the sign-in button on unsolicited 'giveaway' or promotional pages claiming to offer free AI-service subscriptions; navigate directly to the official site (claude.ai / anthropic.com) instead of following the promoted link.
  • Treat any in-page sign-in window as suspect until tested - attempt to drag it outside the boundaries of the hosting webpage before entering any credentials.
  • If Google credentials were already entered on a suspected fake sign-in prompt, immediately change the Google account password, review recent account activity and connected third-party app/OAuth access, and revoke active sessions.

Workarounds

  • Drag-test any in-page sign-in popup toward the edge of the browser window - if it cannot leave the page's content area, it is not a genuine OS-level popup.
  • Treat countdown/scarcity timers on subscription-giveaway pages as decorative; they are client-side generated and unrelated to real inventory.
  • Rely on a password manager that only autofills on the real, legitimate domain - it will stay silent on a fake in-page overlay because the overlay is not the genuine Google origin.

Longer-term hardening

  • Deploy browser-based anti-phishing/URL-reputation extensions (e.g. Malwarebytes Browser Guard or an equivalent enterprise browser-isolation/anti-phishing control) to block known phishing domains before the page loads.
  • Enforce phishing-resistant MFA (FIDO2/WebAuthn hardware security keys) on Google Workspace and any SSO-linked accounts so a captured password alone cannot complete authentication.
  • Run user-awareness training that specifically covers browser-in-the-browser UI spoofing, since it defeats the traditional 'check the address bar' guidance by faking the address bar itself.

Weaknesses (CWE) in Fake Claude Max Giveaway Phishing Campaign Uses

CWE-451, CWE-1021

Timeline of Fake Claude Max Giveaway Phishing Campaign Uses

  • Security researcher mr.d0x publicly documents the browser-in-the-browser (BitB) phishing technique, the UI-spoofing method later reused to build the fake Google sign-in overlay in this Claude Max giveaway campaign.
  • Microsoft observes a separate Anthropic/Claude-impersonating email campaign (fake 'Claude Appeal Request' PDF lure) running April 20-22, 2026 that funnels victims to an adversary-in-the-middle Microsoft sign-in page - a different delivery chain from this BitB giveaway but part of the same AI-brand-impersonation trend.
  • Microsoft publishes 'AI brands as bait,' documenting a broader wave of phishing, malvertising, and SEO-driven campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek to steal credentials and deliver malware.
  • Palo Alto Networks Unit 42 documents a separate browser-in-the-browser campaign using fake, draggable Microsoft 365 login popups (with console-override and bot-redirect evasion) to steal Microsoft credentials - the same BitB technique class applied against a different impersonated brand.
  • Anthropic and Malwarebytes disclose that infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) is separately hijacking already-authenticated Claude browser sessions to drain paid usage allowances - a mechanically distinct but related threat that reinforces that compromised Claude/Google access is actively monetized.
  • Help Net Security publishes coverage summarizing the Malwarebytes findings, amplifying public awareness of the campaign.
  • Malwarebytes researcher Stefan Dasic identifies and publishes analysis of the fake Claude Max giveaway site that uses a browser-in-the-browser Google sign-in overlay to harvest credentials.

Sources cited for Fake Claude Max Giveaway Phishing Campaign Uses

More in phishing

Detection coverage for TL-2026-2627

As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2627 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats