Phishing Invites Sent Straight From OpenAI's Own Servers

Here is a clever one. Attackers are setting up ChatGPT organisations named after real companies, then using OpenAI's own invitation system to ask employees to join. The emails are genuine, sent from [email protected], and they sail through authentication checks for the simple reason that they are exactly what they claim to be: a real invite to a real OpenAI tenant.

Push Security flagged the campaign after several of its own staff received invitations to join an OpenAI organisation called Push Security Inc. The tenant had nothing to do with the company. It had been spun up by someone using Gmail addresses, dressed up to look convincing, with a fake CEO account already sitting inside and a Visa card attached to the billing profile to unlock premium features. The targets were picked carefully, all in cyber security or tech, and contacted on their work addresses.

An empty workspace is the point

When a Push researcher accepted the invite to see what was waiting, they found nothing. An empty workspace and Owner-level privileges handed to every invitee. No malware, no dodgy links, no chats sitting there ready to be opened.

The likely play is patience. Get people using the workspace as if it were a sanctioned corporate tool, then harvest whatever they paste into prompts. Source code, contracts, customer data, internal documents, the kind of material staff routinely feed into AI without thinking twice about where it ends up.

The warning nobody reads

OpenAI does flag that the inviter's domain does not match the recipient's, but the warning is a single line buried in an otherwise legitimate-looking email. It is the sort of detail a busy person scrolls past on the way to clicking accept. The visual cues that normally trigger suspicion, dodgy sender address, broken English, weird formatting, are all absent. Everything about the message looks right because, technically, everything is right.

A pattern worth watching

This is part of a broader shift. Attackers are leaning on the invitation and notification features baked into SaaS platforms because those messages come from trusted infrastructure and breeze past email filters that would catch a more obvious lure. The sender domain is legitimate. The DKIM signature checks out. The content matches what the platform actually sends in the normal course of business.

The same trick works with shared cloud drives, project management tools, code repositories and just about any product that lets one user invite another. Each invite arrives from the platform itself, which means filters trust it and the recipient is already half-convinced before they read the body.

A few things worth keeping in mind:

• An invitation is not a vetting. The fact that an email is genuinely from a known platform tells you nothing about who set up the account on the other end.
• Check the inviter, not the sender. The platform's noreply address is almost always legitimate. The Gmail account that created the tenant is the part that matters.
• An empty workspace is suspicious in itself. Real corporate AI tenants are provisioned by IT, not dropped into your inbox by someone you have never met.

Anything that arrives looking like an invite to a shared workspace deserves a second look before anyone clicks join. The trusted envelope is doing the heavy lifting, and attackers know it.