Fake OpenAI, SpaceX Event Invitations Used in Phishing Campaigns Targeting Microsoft and Google Accounts
Threat actors impersonate leading tech companies to steal credentials and session cookies via two phishing-as-a-service platforms
Key Takeaways
- Fake event invitations from OpenAI, SpaceX, and Anthropic are being used as lures in phishing campaigns.
- Targeted companies include Microsoft and Google employees.
- Two phishing-as-a-service platforms are reportedly involved in the campaigns.
- The attacks aim to steal credentials and session cookies.
- User awareness and MFA are recommended as primary mitigation strategies.
Related Security News
US Charges Two Canadians in University Hacking and Cryptomining Scheme
A federal grand jury has indicted two Canadian nationals for allegedly hacking into multiple US university networks and deploying cryptomining malware on compromised systems. The indictment was unsealed on November 4, 2026.
Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA
A phishing campaign leveraging Google Calendar invites, trusted redirects, and fake login pages has been used to hijack corporate Google sessions and bypass MFA protections. Security firm Material Security attributed the operation to threat actors tracked as Operation CloudFire. Following Material Security's analysis, nearly 900 malicious domains used by the attackers were taken down. The campaign targets corporate Google Workspace users globally, exploiting the trust users place in calendar invites and Google's own infrastructure to deliver convincing phishing pages.
