Fake OpenAI, SpaceX and Anthropic invitations target Microsoft and Google accounts
Fake invitations to events associated with OpenAI, SpaceX and Anthropic are being used to draw employees into phishing attacks, according to the available incident description. The campaigns aim to steal credentials and authentication sessions for Microsoft and Google accounts, combining recognizable company names with phishing-as-a-service tools.
The reported activity involves two different phishing-as-a-service platforms. The description does not identify those platforms, provide the invitation wording or explain how the lures are distributed. It also does not specify affected organizations, the number of targets or the dates of the campaigns. Those details should not be inferred from the limited information available.
Why session theft matters
The stated objective goes beyond collecting account passwords: attackers are also seeking authentication sessions. A stolen session may allow an attacker to act through an account after a user has completed an authentication step, depending on the service’s controls and the circumstances of the theft. This makes the incident relevant to organizations that rely on employee accounts to access email, collaboration tools and other business services.
Invitations to events can appear routine in workplaces where staff follow technology companies or attend industry briefings. A familiar organization’s name is not proof that an invitation is legitimate. Employees should verify unexpected event links through a separate, trusted channel, especially when a page asks them to sign in to a Microsoft or Google account. They should avoid using links in questionable messages to reach login pages.
Practical steps for defenders
Security teams can reinforce reporting procedures for suspicious event invitations and make clear that employees should report the message even if they clicked a link or entered account details. Prompt reporting gives administrators an opportunity to review account activity and respond under their established incident-handling procedures.
Organizations should also ensure that account protections are consistently applied to Microsoft and Google services. Relevant measures include multifactor authentication, controls that limit access to accounts and sessions, and monitoring for unusual sign-ins or other activity that does not fit normal patterns. These measures do not establish that a particular organization was compromised; they are prudent safeguards for accounts targeted by credential and session theft.
Where a user may have submitted credentials or exposed an authenticated session, responders should follow the organization’s account-compromise process. That can include reviewing recent sign-in and account activity, securing the affected account and terminating sessions where the service and the organization’s procedures allow. The available information does not identify a specific indicator of compromise, affected software version or patch, so defenders should not treat any particular technical artifact as confirmed for this activity.
Keep the claims in proportion
The core warning is that attackers are impersonating event invitations tied to OpenAI, SpaceX and Anthropic, and using two phishing-as-a-service platforms to target Microsoft and Google credentials and authentication sessions. The details provided do not establish the scale or success of the campaigns, nor do they name a particular threat actor. Enterprise teams should use the report as a reminder to scrutinize third-party event invitations and maintain response readiness, while relying on their own telemetry to determine whether their users or accounts were affected.
