# Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials

> A phishing site impersonating Anthropic's Claude Max subscription lures victims with a fake giveaway of 10,000 free one-month subscriptions and a manufactured countdown timer, then uses a browser-in-the-browser (BitB) overlay - a fake but convincing Google sign-in window rendered inside the page - to steal victims' Google account credentials.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2627
- **ID:** TL-2026-2627
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes researcher Stefan Dasic disclosed on September 23, 2026 a phishing campaign that impersonates Anthropic and its Claude Max subscription tier. The lure page claims Anthropic has surpassed 100 million users and is giving away 10,000 free one-month Claude Max subscriptions, requiring 'no payment details,' which increases perceived credibility. A countdown display shows fewer than 750-760 of 10,000 slots remaining and decreases every few seconds; the counter is generated client-side in the visitor's browser and resets on every page reload, so every visitor sees an identical, fabricated shortage with no relationship to real inventory.

Clicking the page's Google sign-in button does not open a genuine browser popup. Instead the page renders a fake browser window inside the current tab using HTML/CSS (and, per the underlying technique class, an iframe pointing at the attacker's credential-capture page) - complete with a spoofed address bar, a padlock icon, and a correctly spelled Google sign-in URL. The fake window is draggable, closely mimicking real OS-level popup behavior, but it cannot be dragged past the edge of the hosting webpage - the tell that distinguishes it from a genuine popup and Malwarebytes' recommended user-side detection test. This browser-in-the-browser (BitB) technique was first publicly documented by security researcher mr.d0x in March 2022 and has since been reused in numerous phishing kits.

The flow is engineered to funnel every visitor toward Google credential capture specifically: the Apple sign-in button reports itself as temporarily unavailable, and the email-address input field silently discards typed input and redirects the user into the fake Google flow regardless of what is entered. The BitB sequence opens with a bogus 'human verification' step before any password field appears, a dark-pattern UI element intended to add legitimacy. Malwarebytes also noted the phishing kit pre-fetches color values so its dark-themed fake window renders without a white flash during load, and that source-code comments are written in Russian and refer to the target using victim terminology - both indicators of a maintained, reusable phishing-kit product rather than a one-off page. The overlay itself loads through a single line of code pulled from an outside/third-party service, presented as a reusable sign-in widget, consistent with a BitB-phishing-kit-as-a-service model.

A stolen Google password grants the attacker access to the victim's email, documents, and the password-reset messages of other linked accounts, enabling downstream account-takeover chains. Malwarebytes specifically noted that if a victim uses 'Sign in with Google' for Claude itself, the stolen credential could also grant access to the victim's Claude account - valuable to attackers in its own right because paid Claude usage allowances cost money to replenish. Neither primary source disclosed the phishing domain(s), IP addresses, or file hashes used in this specific campaign, and the exact initial-distribution vector (malvertising, SEO-poisoned search results, or social-media promotion) was not confirmed, though Malwarebytes' guidance to 'avoid clicking promotional links' points toward an ad- or promo-link-driven lure consistent with the broader trend Microsoft documented in June 2026 of malvertising- and SEO-driven campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek. This campaign is mechanically distinct from - but thematically related to - two other 2026 AI-brand threats: an April 2026 Microsoft-tracked Claude/Anthropic-impersonation email campaign using a fraudulent 'Appeal Request' PDF and adversary-in-the-middle infrastructure, and an August-September 2026 wave of infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) hijacking already-authenticated Claude browser sessions to drain paid usage - both underscore that compromised Claude/Google access is being actively monetized by multiple, independent threat clusters.

## MITRE ATT&CK

- T1566 Phishing
- T1204.001 Malicious Link
- T1056.003 Web Portal Capture
- T1036.005 Match Legitimate Resource Name or Location
- T1608.001 Upload Malware
- T1583.008 Malvertising
- T1583.001 Domains
- T1078 Valid Accounts
- T1586.002 Email Accounts
- T1114.002 Remote Email Collection
- T1213 Data from Information Repositories

## Sources

- [Fake Claude Max giveaway hides a Google account phishing trap](https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-claude-max-giveaway-hides-a-google-account-phishing-trap)
- [Fake Claude Max giveaway tricks users into handing over their Google account credentials](https://www.helpnetsecurity.com/2026/09/23/fake-claude-max-giveaway-phishing/)
- [AI brands as bait: How threat actors are using the AI hype in social engineering](https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/)
- [New Browser-in-the-Browser phishing uses fake login popups to steal Microsoft 365 credentials](https://www.helpnetsecurity.com/2026/06/10/browser-in-the-browser-phishing-microsoft-365-users/)
- [New Browser-in-the-Browser (BITB) Attack Makes Phishing Nearly Undetectable](https://thehackernews.com/2022/03/new-browser-in-browser-bitb-attack.html)
- [mrd0x/BITB - Browser In The Browser (BITB) Templates](https://github.com/mrd0x/BITB)
- [Infostealers are hijacking Claude accounts at users' expense](https://www.malwarebytes.com/blog/news/2026/09/infostealers-are-hijacking-claude-accounts-at-users-expense)
- [Anthropic locks out Claude users after infostealers hijack login sessions](https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2627