Home / Technology / Hackers Exploit AI Hype for Corporate Account Access
Hackers Exploit AI Hype for Corporate Account Access
15 Nov
Summary
- Cybercriminals create fake AI event invitations to steal work accounts.
- Attackers impersonate major tech firms like OpenAI and SpaceX.
- Scams trick users into sharing credentials via fake sign-in pages.
In late October 2026, malicious actors began targeting employees with convincing fake event invitations, impersonating prominent AI and aerospace companies such as OpenAI, SpaceX, and Anthropic. These phishing campaigns exploit the growing interest in artificial intelligence, offering lures like free ChatGPT Pro or exclusive briefings. The primary goal is to trick recipients into registering with their corporate Microsoft or Google accounts.
Attackers employ multi-stage tactics to enhance credibility, using shortened links and familiar services like Zapier or Cloudflare security challenges. Once on a fake registration page, users are presented with options to 'Continue with Microsoft' or 'Continue with Google'. These lead to sophisticated phishing mechanisms designed to capture authentication tokens or session cookies, bypassing traditional password and even some multi-factor authentication methods.
Microsoft has stated its Defender includes detections for these threats, working to protect customers. While Push Security, which identified the campaign, blocked access to malicious pages, the full extent of compromises remains unconfirmed. Employees are advised to verify event invitations independently, be wary of excessive rewards, and never enter device codes they didn't request. Using strong security measures like phishing-resistant authentication remains crucial.
