Malwarebytes Finds Fake Claude Max Giveaway Built to Steal Google Logins

A free month of Claude Max is the bait; a Google password is the target. Malwarebytes has uncovered a phishing site that poses as an Anthropic giveaway and draws a convincing Google sign-in window inside its own page. The window looks separate, but entering credentials there would hand them to the scammers.

The offer is designed to look routine

The site falsely says Anthropic is celebrating 100 million users by giving 10,000 people a free month of Claude Max. It borrows Anthropic’s logo and colors, displays invented five-star reviews, and fills a long footer mostly with links to genuine Anthropic pages. Those real destinations help the fake offer look credible without making the offer real.

A counter claims that fewer than 750 subscriptions remain and ticks downward. Malwarebytes found that nothing is being counted: the number is generated in the visitor’s browser and resets when the page reloads. The site also repeatedly promises that no payment details are needed. That promise is true in a narrow sense, because this scam wants a login rather than a card number.

Every sign-in route leads to Google

Visitors appear to have choices, but the page funnels them toward one prompt. Its Apple sign-in button says it is temporarily unavailable. The email box ignores what a visitor types and triggers the Google button instead. Clicking that button does not open Google: it makes the phishing page draw a window inside the existing browser tab.

The imitation has a correctly spelled Google sign-in address and a padlock. It can even be dragged around, like a separate popup. But those details are pictures and controls supplied by the phishing site. The browser’s real address bar, at the top of the screen, still shows that site’s domain. Malwarebytes says the prompt begins with a human-verification step before showing a password box.

Why a free AI plan could cost more

The potential loss is not limited to Claude. A stolen Google login could expose email and documents, along with password-reset messages for other accounts. If someone uses Google to sign in to Claude, the same credentials could also give the attacker a route into that account. These are potential consequences of a compromised login, not a count of accounts breached in this campaign.

The fake login is not an elaborate window built solely for this giveaway. Malwarebytes found that the page loads its malicious sign-in function with a single line of code from an outside service presented as a reusable widget. That finding explains how a polished-looking prompt can be added to this site; it does not identify who operates the campaign.

Check the window, not its picture

The scam exploits a habit that normally helps: checking the address and padlock before signing in. Here, both appear inside a window the site drew. Malwarebytes recommends checking signals the page cannot draw for itself:

• Look at the browser’s actual address bar above the page, not the address displayed inside the sign-in prompt.
• Try dragging the supposed popup beyond the edge of the webpage. A window drawn by the site cannot leave it.
• Notice if your password manager does not offer to fill a Google password where it normally would. It checks the real web address.
• Visit Anthropic’s site directly to check a promotion instead of following a link to the offer.

If you already entered a password, closing the tab will not undo it. Malwarebytes advises changing the password through Google’s real site, signing out of other sessions, and reviewing connected apps and unfamiliar devices.

The campaign’s reach is still unknown

Malwarebytes researcher Stefan Dasic told CNET it was too early to say how widely the scam had spread or how many people it had reached. Investigators traced the site to a UK-registered company, but the server was rented; that trail does not identify who rented it. For now, the warning rests on the site’s observed behavior, not a known victim total or a confirmed operator.