🚨 Fake Claude Max Giveaway Uses a Fake Google Login Window to Steal Credentials

VERIFIED EMERGING SCAM ALERT

Report date: September 23, 2026

Scam type: AI-service impersonation / fake giveaway / Google-account credential phishing

What happened

Malwarebytes Threat Intelligence reported a newly observed phishing campaign that impersonates Anthropic and promises a free one-month Claude Max subscription. The fraudulent page claims Anthropic has passed 100 million users and is giving away 10,000 free subscriptions, using familiar branding, invented five-star reviews, and footer links that largely point to genuine Anthropic pages to make the offer appear legitimate.

The campaign does not primarily ask for a credit card or software download. Instead, it prompts the victim to sign in with a Google account. The phishing page then displays a fake browser-style Google sign-in window designed to make the victim believe the login is occurring on a legitimate Google page.

How the scam works

The victim encounters a promotion offering Claude Max for free. Scarcity language suggests only a limited number of subscriptions remain. When the victim chooses the offer, the site presents what appears to be a Google sign-in window. The visual trick includes familiar browser cues, but the window is part of the phishing page rather than a genuine browser-controlled Google login. Credentials entered there can be captured by the attacker.

The important verification point is the real browser address bar at the very top of the browser. A padlock, URL, or login window drawn inside a webpage can be fabricated. Microsoft previously documented a broader rise in phishing, malicious advertising, and search-based campaigns impersonating popular AI services, including ChatGPT, Claude, DeepSeek, and Copilot, which independently supports the broader threat pattern.

Who is targeted

The lure is aimed at consumers and AI users attracted by a free upgrade to a paid AI subscription. Anyone who uses Google sign-in for online services may be especially vulnerable because the fake authentication window imitates a familiar login flow.

Warning signs

Watch for unsolicited offers promising expensive AI subscriptions for free; countdowns or claims that only a small number of subscriptions remain; requests to sign in through a pop-up or browser window that appears inside the webpage; a real browser address bar that still shows an unrelated domain; and promotions whose branding looks polished but whose offer cannot be confirmed through the company's official website or app.

What consumers should do

Do not enter Google credentials through an unexpected giveaway link. Navigate independently to the AI provider's official website or app and verify whether the promotion exists. When a login window appears, check the actual browser address bar rather than an address bar drawn inside the webpage. Use a password manager where practical because it can help expose lookalike domains by refusing to autofill credentials on the wrong site. If you entered credentials on a suspicious page, change the affected password from a trusted device, review account security and active sessions, enable multi-factor authentication, and check recovery information for unauthorized changes.

Why this development matters

This is a meaningful scam variation because it combines the popularity and cost of premium AI subscriptions with a sophisticated visual deception: a fake browser window. Consumers are often taught to look for a padlock and correct URL before signing in, but attackers can draw those trust signals inside a webpage. The only address bar that matters is the one controlled by the actual browser.

Sources

Primary threat-intelligence source: Malwarebytes — Fake Claude Max giveaway hides a Google account phishing trap, September 23, 2026: https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-claude-max-giveaway-hides-a-google-account-phishing-trap

Corroborating threat pattern: Microsoft Security previously reported growing phishing, malicious-advertising, and search-based campaigns impersonating popular AI services. This AigiShield article is therefore classified as a Verified Emerging Scam Alert, not an official U.S. government warning.

AigiShield reminder

Think it might be a scam? Let AigiShield check it out for you.

Think Before You Click. Verify Before You Trust.