Fake Claude Max giveaway steals Google account credentials

Malwarebytes found a phishing campaign using a fake Claude Max giveaway with a spoofed Google sign-in window to steal login credentials. The browser-in-the-browser technique has been known since 2022, and the malicious widget loads via a single line of code.

• Fake page promises 10,000 free one-month Claude Max subscriptions
• The 'slots left' counter is generated in the browser and resets on reload
• The draggable fake Google window mimics the address bar and padlock
• The malicious widget loads via one line of code, with Russian comments