I’ve clicked my fair share of “free upgrade” banners to see how the trick works, and this is one of the most convincing I’ve seen.
Security firm Malwarebytes just exposed a phishing campaign that is disguised as a “Claude Max x20” giveaway, a subscription that otherwise costs $200 per month. Typically spread through malicious ads, search-based campaigns, or phishing messages, it doesn’t steal your card details; it goes for something more valuable: your Google account details.
So how does this scam actually pull you in?
The fake page lures victims in with a rather appealing message. It claims that Anthropic (the AI company behind the chatbot Claude) just hit a massive user milestone. To celebrate, it is handing out thousands of free Claude Max subscriptions.
If that message showed up alone on a web page, that would be fishy. However, the bad actors also duped the real logos, added fake five-star reviews, and added a countdown for urgency; none of it is real.
What makes people trust it more than other phishing campaigns is that it never asks for payment information. However, that’s more bait than something you should worry about. The dialogue box on the screen asks people to sign in to claim the offer, and that’s where the real catch is.
Like regular websites, the webpage lets you sign in with your Google or Apple account. However, conveniently enough, the Apple sign-in feature claims to be unavailable, pushing everyone toward a fake Google login.
What makes this fake login window so convincing?
Clicking the “Sign in with Google” button opens a fake browser window (one you can drag around the screen like a normal one) directly inside the page. It contains a correctly spelled address and padlock icon (both entirely fake).
The moment you enter your Google account’s credentials into the text field, the bad actors get hold of them. Needless to say, that would give them access to your emails, documents, sensitive banking information, and the ability to reset your password and lock you out of the account.
If you use Google to sign in to other services, bad actors could also get their hands on those. This is why I called it something that’s even more dangerous than your banking details.
The best piece of advice I have for you: don’t fall for free things on the internet. If you think something is legitimate, try to verify it with the product or service provider through their official website, social handles, or a customer support agent who can confirm it.
