Fake OpenAI, SpaceX, Anthropic Event Invites Used to Phish Microsoft and Google Credentials

What happened

According to BleepingComputer, threat actors are sending fake event invitations that impersonate OpenAI, SpaceX, and Anthropic to lure employees to phishing pages. The campaign uses two separate phishing-as-a-service (PhaaS) platforms to steal Microsoft and Google account credentials and active authentication sessions.

Why it matters

Lures that reference trusted brands like OpenAI and SpaceX can be harder for employees to dismiss than generic phishing. Because the kits capture authentication sessions, stolen session tokens can be used to bypass MFA on Microsoft and Google accounts, which gives attackers access beyond a one-time password. Any organization whose employees might plausibly receive tech-industry event invitations could be a target.

What defenders should watch for

• Hunt for inbound email referencing event invitations from OpenAI, SpaceX, Anthropic, or similar brands, especially from lookalike or newly registered domains.
• Review sign-in logs for anomalous session or token reuse (impossible travel, or a new device or IP paired with an existing session token) on Microsoft 365 and Google Workspace, since the source reports the kits target authentication sessions.
• Flag URLs and redirect chains that match known adversary-in-the-middle (AiTM) PhaaS patterns in proxy and email-gateway logs.
• Remind users to verify unsolicited event invitations from well-known AI and tech companies out of band before clicking.
• Consider conditional access policies that limit session token validity or require re-authentication for high-risk sign-ins.

Developing story

This is based on early reporting. The specific PhaaS platforms, infrastructure indicators, and full victim scope are not detailed in the source. Treat this as developing intelligence. Read the original report at BleepingComputer.