Anthropic-Themed Phishing Emails Are Bypassing Secure Email Gateways — Detection and Defense Guide

Introduction

Security researchers have confirmed that blatantly obvious phishing emails impersonating Anthropic — the AI company behind Claude — are successfully bypassing some of the industry's leading secure email gateway (SEG) products. These are not sophisticated, near-perfect lures. Reporting indicates the messages carry numerous classic red flags: mismatched sender domains, suspicious links, urgent call-to-action language, and branding inconsistencies that any analyst would spot in seconds. Yet they are landing in user inboxes anyway.

This matters for two reasons. First, the campaign exploits the explosive enterprise adoption of AI tools — employees expect legitimate emails from AI vendors about account upgrades, API billing, workspace invitations, and usage limits, which dramatically raises click rates. Second, and more concerning, it demonstrates a structural weakness in perimeter email filtering: SEGs tuned to catch malware and known-bad infrastructure are consistently failing against text-based social engineering that rides on clean, newly registered, or compromised-but-reputable sending infrastructure.

If your organization's email defense strategy is 'the gateway will catch it,' this campaign is your wake-up call. The assumption that a properly configured SEG equals a protected user base is demonstrably false in 2026, and defenders need layered detection at the endpoint, identity, and network layers today.

Technical Analysis

What Is Being Observed

Based on the reporting, the campaign exhibits the following characteristics:

• Lure theme: Impersonation of Anthropic communications — account notifications, billing or subscription alerts, workspace/team invitations, and security-verification style messages capitalizing on the brand's enterprise footprint.
• Red flags present but ineffective against SEGs: Sender domains that do not match legitimate Anthropic infrastructure, embedded links pointing to non-Anthropic domains, and generic social engineering pressure tactics.
• Bypass mechanism: The emails carry no traditional malicious payload — no weaponized attachments, no known-bad URLs at time of delivery. Many SEGs rely heavily on attachment sandboxing and URL reputation at delivery time. A clean-looking HTML email with a link to a freshly registered domain (or a legitimate redirector/URL shortener) scores as benign and is delivered.
• Payload delivery model: Click-based. The attack chain begins when the user clicks the embedded link and is directed to a credential-harvesting page or a malicious download, typically a fake Claude login portal designed to steal SSO credentials or session tokens.

Attack Chain (Defender's View)

1. Delivery: Email bypasses SEG due to clean attachment profile, low-reputation-age sender domain not yet on blocklists, and text-only social engineering content that evades signature-based and many ML-based classifiers.
2. Click: User clicks link in email client or browser. Network telemetry shows an outbound connection to a domain with Anthropic-themed naming (e.g., lookalike or typosquatted domains) or a legitimate redirector.
3. Harvest/Execute: Victim lands on a credential phishing page mimicking an AI platform login, or is served a download (often an HTML file, ISO, or script) that initiates follow-on execution — frequently via browser-spawned script interpreters such as mshta.exe, powershell.exe, or wscript.exe.
4. Post-compromise: Stolen credentials are replayed against the organization's identity provider; session token theft enables MFA bypass via adversary-in-the-middle (AiTM) proxy kits.

Why the SEGs Failed

Modern SEGs are highly effective against commodity malware and known-bad infrastructure, but social engineering content detection remains probabilistic. Attackers exploit:

• Newly registered domains (NRDs) with zero reputation history
• Legitimate redirectors and hosting (cloud storage links, URL shorteners, compromised WordPress sites)
• Brand impersonation text that ML classifiers score as legitimate marketing-style email
• Time-of-click vs. time-of-delivery gap: URLs weaponized after delivery bypass any gateway that only scans at receipt

Exploitation Status

Confirmed active in-the-wild campaign with successful delivery past multiple leading SEG vendors. No CVE is associated with this activity — it is a technique-level failure of email perimeter controls, not a software vulnerability. This is precisely why patching cannot fix it and layered detection is required.

Detection & Response

Because the email layer has already failed by the time your SOC sees this threat, your detection engineering must focus on the post-delivery behaviors: the click, the connection to lookalike infrastructure, the credential submission, and any follow-on execution. The rules below are tuned for high fidelity — they target behaviors with low legitimate occurrence rates.

Sigma Rules

---
title: Browser Process Spawning Script Interpreter or Shell
description: Detects web browsers spawning script interpreters or shells, consistent with phishing link or malicious download execution following a clicked email lure such as the Anthropic-themed campaign.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/anthropic-phishing-emails-bypass-security-tools
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 3f8a1c92-7d4e-4b61-a95c-2e6d8f401234
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\OUTLOOK.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate browser extensions or enterprise web apps launching local helpers — tune per environment
level: high
---
title: Office or Email Client Launching HTML Application or Script Host
description: Detects Outlook or other email clients spawning mshta, wscript, or cscript, a common pattern when users open malicious HTML attachments or links from phishing emails that evaded the SEG.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/anthropic-phishing-emails-bypass-security-tools
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 91b4e7d3-2c5f-4a86-b8d1-6f3a9c507812
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\thunderbird.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy CRM or ERP add-ins integrated with Outlook — investigate before excluding
level: high
---
title: PowerShell Web Download Cradle from User Context
description: Detects PowerShell download cradles frequently used in the second stage of phishing attacks after a user clicks a lure link that bypassed email gateway inspection.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/anthropic-phishing-emails-bypass-security-tools
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: c7d2f481-9a3b-4e57-bd26-8f1e5a903467
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Start-BitsTransfer'
      - 'curl.exe'
  filter_legit:
    CommandLine|contains:
      - 'chocolatey'
      - 'winget'
  condition: selection_img and selection_cli and not filter_legit
falsepositives:
  - Administrator automation and software deployment scripts — baseline admin tooling and exclude known service accounts
level: medium

KQL Hunt — Microsoft Sentinel / Defender

This query hunts for endpoint network connections to Anthropic-lookalike domains shortly after email delivery, plus browser-spawned script execution. Run it across the last 14 days and pivot on any hits. Note that the legitimate Anthropic domains (anthropic.com, claude.ai) are excluded — anything else matching the brand pattern in your network traffic deserves scrutiny.

// Hunt: connections to Anthropic/Claude lookalike domains + browser-spawned script execution
// Stage 1: Network connections to brand-lookalike domains (exclude legitimate Anthropic infrastructure)
let LookalikeConnections = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("anthropic", "claude")
| where RemoteUrl !has_any ("anthropic.com", "claude.ai", "claude.com")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
// Stage 2: Browser or Outlook spawning script interpreters within the same window
let SuspiciousExecution = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","OUTLOOK.EXE")
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","cmd.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
LookalikeConnections
| union SuspiciousExecution
| sort by TimeGenerated desc

For environments ingesting email gateway or proxy logs into Sentinel, correlate with CommonSecurityLog to identify which users received messages from newly registered sender domains:

// Hunt: emails delivered from young/lookalike domains referencing Anthropic branding
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where Message has_any ("anthropic", "claude")
| where SourceHostName !has "anthropic.com" and DestinationUserName != ""
| project TimeGenerated, SourceHostName, SourceAddress, DestinationUserName, Message
| sort by TimeGenerated desc

Velociraptor VQL Hunt

Use this artifact to sweep endpoints for the post-click execution artifacts typical of this campaign — browser-spawned script interpreters and suspicious downloads in user directories.

-- Hunt: browser-spawned script interpreters and recent suspicious downloads
-- Relevant to phishing lures that bypassed the SEG and executed after user click
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)powershell|pwsh|mshta|wscript|cscript'
       AND CommandLine =~ '(?i)http|DownloadString|Invoke-WebRequest|Invoke-RestMethod')
   OR Exe =~ '(?i)\\\\AppData\\\\Local\\\\Temp\\\\'

-- Correlate with recently created files in user Download folders (potential phishing payloads)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:\\Users\\*\\Downloads\\*.html')
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC

Hardening Script — Microsoft 365 / Defender for Office 365

This PowerShell script configures Tenant Allow/Block List entries for Anthropic-lookalike domains, tightens anti-phishing policy impersonation protection, and verifies key settings. Review and adapt domain entries to intelligence gathered in your own environment — do not blindly block legitimate infrastructure.

# Requires: ExchangeOnlineManagement module, Exchange Admin or Security Admin role
# Connect-ExchangeOnline

# 1) Add lookalike domains to the Tenant Block List (replace with intel from YOUR environment)
$blockDomains = @("anthropic-support.com", "claude-billing.net", "anthropic-verify.com")
foreach ($d in $blockDomains) {
    New-TenantAllowBlockListItems -ListType Url -Block -Entries $d -ExpirationDate (Get-Date).AddDays(90) -ErrorAction SilentlyContinue
    Write-Host "Blocked URL/domain: $d"
}

# 2) Verify impersonation protection is enabled in anti-phishing policy
Get-AntiPhishPolicy | Select-Object Name, EnableTargetedUserProtection, EnableOrganizationDomainsProtection, EnableMailboxIntelligence, PhishThresholdLevel

# 3) Enable first-contact safety tip and user impersonation protection if not set
Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" -EnableFirstContactSafetyTips $true -EnableViaTag $true -EnableTargetedUserProtection $true

# 4) Audit: verify DMARC/DKIM enforcement on inbound mail
Get-AntiPhishPolicy | Select-Object Name, SpoofIntelligenceType, HonorDmarcPolicy, DmarcRejectAction, DmarcQuarantineAction

# 5) Verify Safe Links time-of-click protection is active (critical against post-delivery weaponization)
Get-SafeLinksPolicy | Select-Object Name, IsEnabled, ScanUrls, EnableForInternalSenders, DeliverMessageAfterScan

Remediation

There is no patch for this threat — it is a control-architecture failure, not a software bug. Remediate by closing the detection gaps the campaign exploits:

1. Assume delivery. Re-architect email security on the premise that some percentage of phishing will reach the inbox. Shift investment toward post-delivery controls: Safe Links/time-of-click URL rewriting, automated reported-message triage, and rapid mailbox purge (via Microsoft 365 Explorer or Google Workspace equivalent).

2. Enable time-of-click URL protection. If your SEG or Defender for Office 365 Safe Links is not actively rewriting and re-scanning URLs at click time, enable it now. Time-of-delivery scanning alone is what this campaign defeats.

3. Deploy brand-impersonation detection. Configure anti-phishing policies to flag messages referencing brands your organization actually uses (Anthropic, OpenAI, Microsoft, your IdP) when sent from non-corporate domains. Add your own executives to user impersonation protection.

4. Block newly registered domains at the DNS/proxy layer. Enforce NRD blocking (domains younger than 30 days) at your secure web gateway or DNS resolver. This single control neutralizes a large share of lookalike landing pages regardless of email delivery.

5. Enforce phishing-resistant MFA. The endgame of these lures is credential and session theft. FIDO2/passkeys and number-matching push defeat AiTM-style replay. Audit your IdP for legacy authentication protocols and disable them.

6. Tune your reported-phish pipeline. Users are your compensating sensor when the gateway fails. Ensure the report button is frictionless, reported messages trigger automated similar-message purge across all mailboxes, and reports feed your SEG vendor's detection loop.

7. Hunt now. Run the KQL and VQL queries above across the past 14–30 days. Any hits on Anthropic/Claude lookalike domains warrant credential-reset and session-revocation for the affected identities, plus review of IdP sign-in logs for anomalous token use.

8. Brief your users on AI-vendor lures specifically. Security awareness content from 2023 doesn't cover this. Employees receiving 'Claude workspace invite' or 'Anthropic billing failure' emails should be trained to navigate directly to the service rather than clicking.

The broader lesson for security leadership: SEG efficacy metrics based on malware catch rates are masking a growing social-engineering blind spot. Measure your email program by time-to-detect and time-to-purge after delivery, not just by what the gateway blocks at the perimeter.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub