GoKawiilFake Claude Max giveaway scam steals Google account credentials
Malwarebytes reported a phishing campaign that impersonates a promotion from Anthropic, falsely claiming to offer 10,000 users a free month of Claude Max to mark 100 million users. Victims who click through are directed to a fake Google login page designed to steal their credentials, using a convincing 'browser-in-a-browser' overlay that mimics a real Google sign-in window.
GoKawiil's interpretation of the reporting above, not reported fact.
Because Claude accounts rely on Google sign-in rather than a separate password, researchers suggest the scam is especially effective at capturing credentials that could unlock a victim's email, documents and other linked accounts. The high production quality—accurate logos, fake reviews and a live counter—indicates phishing techniques are becoming harder for everyday users to detect, which could increase the risk of successful credential theft campaigns targeting AI service users.
- A phishing scam falsely offers free Claude Max access tied to a fake '100 million users' milestone
- The attack uses a fake Google login overlay to steal credentials, since Claude has no separate password system
- Malwarebytes says the scam's polished design, including real logos and fake reviews, makes it unusually convincing
YubiKey 5 NFC Security Key — Phishing scams like this fake Claude Max giveaway rely on tricking you into typing your Google password into a lookalike page. A hardware security key like the YubiKey adds a physical authentication step that phishing sites simply can't replicate, so even if your password gets stolen, attackers can't log in. It's a simple, one-time setup that dramatically hardens your Google account against exactly this kind of credential theft.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: cnet.com — Omar Gallaga, 2026-09-23
Published there as: “New Phishing Attack Promises Claude Max, but Steals Your Google Credentials Instead”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.