Phishing campaign reportedly steals Microsoft and Google account credentials
BleepingComputer reports that attackers are sending fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing pages.
Written by a model from the sources below. Verify against them.
- Vendor
- Microsoft
- Product
- SharePoint
- Status
- Reported, not confirmed
- Disclosed
- BleepingComputer: “Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platf…”
- Phishing or social engineering
Summary
The item says two phishing-as-a-service platforms are being used to steal Microsoft and Google credentials and authentication sessions.
What to do
Treat unexpected event invitations from AI and aerospace companies as suspicious and verify them through official channels
Enable phishing-resistant multi-factor authentication on Microsoft and Google accounts
Review active sessions and revoke any you do not recognize
Timeline
- First seen by cve.now
- Made public by BleepingComputer
Evidence 1
- PressBleepingComputer
“Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions.”
+1 more: BleepingComputer on Bluesky
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Microsoft breach
Was Microsoft breached?
BleepingComputer reports it. No statement from Microsoft has reached cve.now yet.
What should Microsoft customers do?
Treat unexpected event invitations from AI and aerospace companies as suspicious and verify them through official channels. Enable phishing-resistant multi-factor authentication on Microsoft and Google accounts. Review active sessions and revoke any you do not recognize.