# SZB-fe91205ead: Phishing campaign reportedly steals Microsoft and Google account credentials

BleepingComputer reports that attackers are sending fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing pages.

- Type: Breach
- Status: Reported, not confirmed
- Vendor: Microsoft
- Product: SharePoint
- Disclosed: 2026-11-05 21:30 UTC
- Way in: Phishing or social engineering (BleepingComputer: “Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platf…”, [source](https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/))
- Sources: 2 distinct
- First seen by cve.now: 2026-11-05 16:28 UTC · Updated: 2026-11-06 02:35 UTC

> No statement or filing from Microsoft has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

The item says two phishing-as-a-service platforms are being used to steal Microsoft and Google credentials and authentication sessions.

## What to do

- Treat unexpected event invitations from AI and aerospace companies as suspicious and verify them through official channels
- Enable phishing-resistant multi-factor authentication on Microsoft and Google accounts
- Review active sessions and revoke any you do not recognize

## Timeline

- 2026-11-05 16:28 UTC: First seen by cve.now
- 2026-11-05 21:30 UTC: Made public by BleepingComputer
- 2026-11-06 02:35 UTC: Record last updated

## Evidence (2 sources)

- 2026-11-05 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/): “Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzlsuwg54l2b))
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@cyberseckyle/117567148763139696): “Microsoft observed AI agents using stolen app credentials for Entra/Azure access and Key Vault data theft, once just five minutes after searching GitHub for secrets.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-fe91205ead&body=https%3A%2F%2Fcve.now%2FSZB-fe91205ead%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the Microsoft breach

### Was Microsoft breached?

BleepingComputer reports it. No statement from Microsoft has reached cve.now yet.

### What should Microsoft customers do?

Treat unexpected event invitations from AI and aerospace companies as suspicious and verify them through official channels. Enable phishing-resistant multi-factor authentication on Microsoft and Google accounts. Review active sessions and revoke any you do not recognize.

## Related

- Started as early warning SZB-fe91205ead, first seen 2026-11-05 16:28 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-fe91205ead
Site guide for agents: https://cve.now/llms.txt