Attackers use fake OpenAI workspaces to target company employees

Summary

Push Security says attackers created fake OpenAI workspaces impersonating cybersecurity and technology firms, then sent legitimate platform invitations to employees. It suspects the goal was to collect sensitive data entered into ChatGPT; no data theft was reported.

Key points

Push Security says employees at cybersecurity and technology companies received legitimate OpenAI invitations to attacker-created workspaces impersonating their employers.
The invitations targeted work email addresses and came through OpenAI’s notification system, passing email authentication checks.
A Push Security researcher who accepted an invitation found an empty workspace with an attacker-controlled Gmail account; invited employees had Owner privileges, and a payment card was attached.
Push Security believes the attackers aimed to persuade employees to enter sensitive company information into ChatGPT, but the workspace had no existing chats or projects and data theft was not reported.
Push Security recommends verifying unexpected organization invitations and monitoring SaaS organization memberships.

Article Details

Event Type: Social-engineering campaign abusing legitimate OpenAI organization invitations
Impact: Employees at cybersecurity and technology companies were invited to attacker-created ChatGPT organizations impersonating their employers. Push Security believes the goal was to induce employees to submit sensitive company information, such as source code, documents, customer data, security research, and strategic plans. The article reports no evidence that invitees joined or that data was submitted.