--- title: Anthropic-Themed Phishing Emails Bypass Top Security Tools description: A phishing campaign impersonating Anthropic is slipping past leading email security tools despite obvious red flags. Cofense found the emails, sent since... canonical: https://daily.dev/posts/anthropic-themed-phishing-emails-bypass-top-security-tools-ne9eily46 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic-Themed Phishing Emails Bypass Top Security Tools | daily.dev og:description: A phishing campaign impersonating Anthropic is slipping past leading email security tools despite obvious red flags. Cofense found the emails, sent since... og:url: https://daily.dev/posts/anthropic-themed-phishing-emails-bypass-top-security-tools-ne9eily46 og:image: https://api.daily.dev/og/posts/nE9eiLy46.png og:image:alt: Anthropic-Themed Phishing Emails Bypass Top Security Tools og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic-Themed Phishing Emails Bypass Top Security Tools **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A phishing campaign impersonating Anthropic is slipping past leading email security tools despite obvious red flags. Cofense found the emails, sent since September, got through Proofpoint SEG and Microsoft Defender for Office 365, and pointed to a legitimate GoTo Webinar sender address, a Zapier-shortened link, and two separate CAPTCHAs as possible explanations. The emails offer a fake 'private preview' of an Anthropic AI tool and lead victims through a fake Zoom page to steal Google or Microsoft SSO credentials. Since October 28, the attacker has also spoofed Anthropic's own website instead of Zoom's. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How are phishing emails bypassing Proofpoint Secure Email Gateway and Microsoft Defender for Office 365? Attackers use a legitimate shared sender address (customercare@gotowebinar.com), run malicious links through the Zapier URL shortener to hide red flags, and add two CAPTCHAs (one Cloudflare CAPTCHA before the fake page, another blocking VPNs and Tor before the SSO page). This combination, used in an Anthropic-themed campaign since September, let obviously suspicious emails pass industry-leading filters. _Teams hardening email defenses against lookalike campaigns can track emerging bypass techniques on daily.dev._ ### What should organizations do if an employee's Google or Microsoft SSO credentials get phished? Strict least-privilege access, phishing-resistant multifactor authentication, and privileged access management prevent an attacker from moving laterally or elevating privileges after credential theft, according to Keeper Security CISO Shane Barney. A centralized password manager that validates domain URLs before autofilling credentials also stops lookalike-domain attacks at the point of interaction. _Security teams building identity-first defenses can follow practical guidance like this on daily.dev._ ## Similar posts on daily.dev - [New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale](https://daily.dev/posts/new-advanced-phishing-kits-use-ai-and-mfa-bypass-tactics-to-steal-credentials-at-scale-szahgtrcz) · The Hacker News · 0 upvotes · 0 comments - [Phishing poses as big-brand job interview to steal Google accounts](https://daily.dev/posts/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts-dzdiizpk7) · BleepingComputer · 1 upvotes · 0 comments - [Hackers Target Cybersecurity Firm Outpost24 in 7-Stage Phish](https://daily.dev/posts/hackers-target-cybersecurity-firm-outpost24-in-7-stage-phish-xl7wgp4qt) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#anthropic](https://daily.dev/tags/anthropic), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/anthropic-themed-phishing-emails-bypass-top-security-tools-ne9eily46) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anthropic-Themed Phishing Emails Bypass Top Security Tools","url":"https://daily.dev/posts/anthropic-themed-phishing-emails-bypass-top-security-tools-ne9eily46","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anthropic-themed-phishing-emails-bypass-top-security-tools-ne9eily46"},"datePublished":"2026-10-29T21:55:45.041Z","dateModified":"2026-10-29T22:02:41.964Z","description":"A phishing campaign impersonating Anthropic is slipping past leading email security tools despite obvious red flags. Cofense found the emails, sent since...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d520c5edb9e49bb277d1caf88ad3188e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d520c5edb9e49bb277d1caf88ad3188e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/anthropic-themed-phishing-emails-bypass-top-security-tools-ne9eily46","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,anthropic,phishing","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Anthropic-Themed Phishing Emails Bypass Top Security Tools"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/anthropic-themed-phishing-emails-bypass-top-security-tools-ne9eily46#faq","mainEntity":[{"@type":"Question","name":"How are phishing emails bypassing Proofpoint Secure Email Gateway and Microsoft Defender for Office 365?","acceptedAnswer":{"@type":"Answer","text":"Attackers use a legitimate shared sender address (customercare@gotowebinar.com), run malicious links through the Zapier URL shortener to hide red flags, and add two CAPTCHAs (one Cloudflare CAPTCHA before the fake page, another blocking VPNs and Tor before the SSO page). This combination, used in an Anthropic-themed campaign since September, let obviously suspicious emails pass industry-leading filters. Teams hardening email defenses against lookalike campaigns can track emerging bypass techniques on daily.dev."}},{"@type":"Question","name":"What should organizations do if an employee's Google or Microsoft SSO credentials get phished?","acceptedAnswer":{"@type":"Answer","text":"Strict least-privilege access, phishing-resistant multifactor authentication, and privileged access management prevent an attacker from moving laterally or elevating privileges after credential theft, according to Keeper Security CISO Shane Barney. A centralized password manager that validates domain URLs before autofilling credentials also stops lookalike-domain attacks at the point of interaction. Security teams building identity-first defenses can follow practical guidance like this on daily.dev."}}]} ```