Threat actors are abusing OpenAI’s organization invite feature by creating fake tenants that impersonate real companies and sending legitimate-looking invitations to employees. The goal appears to be luring targets into joining fraudulent ChatGPT workspaces where they may unknowingly submit sensitive company information, such as source code, documents, and strategic plans. #OpenAI #PushSecurity #AdamBateman
Keypoints
- Attackers created fake OpenAI organizations that impersonated legitimate companies.
- Employees received real invitation emails sent through OpenAI’s own notification system.
- The campaign specifically targeted workers using their company email addresses.
- Invited users were given Owner privileges and saw a billing card attached to the tenant.
- Push Security believes the aim was to collect sensitive data entered into ChatGPT chats and projects.