What Happened
A new Microsoft 365 phishing campaign is using fake OpenAI, SpaceX, and Anthropic event invitations to steal employee credentials. BleepingComputer reports the campaign relies on two different phishing-as-a-service platforms, and it targets both Microsoft and Google accounts. For an MSP, one successful click can compromise a client's email, data, and downstream systems, and the cleanup bill is on you.
The invitations are fake, and employees who engage with them are sent to phishing pages that collect the credentials and authentication sessions, according to BleepingComputer. That means an attacker can gain access to an account, not just its password.
What this costs an MSP: a compromised account can lead to business email compromise, ransomware, or data exfiltration, and you own the response. The best time to act is before clients click.
Timeline
No detailed timeline of the campaign has been published yet. The only date from the source is November 5, 2026, when BleepingComputer published its report.
Who Is Affected
The campaign targets employees at organizations that use Microsoft or Google accounts. The fake OpenAI, SpaceX, and Anthropic event invitations are the lure, so employees who follow those companies or are likely to click on event invites are the immediate targets.
BleepingComputer does not name specific industries, company sizes, or geographies. In practical terms, any organization with staff using Microsoft 365 or Google Workspace should treat this as in scope, and MSPs should expect pressure on their clients' employees.
Technical Details
No CVE is associated with this campaign, and BleepingComputer does not name a specific vulnerability, product version, or exploit.
The attack vector is phishing. According to BleepingComputer, the campaign uses two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. Fake event invitations from OpenAI, SpaceX, and Anthropic are the initial lure.
The report does not disclose the names of the phishing kits, the hosting infrastructure, or any indicators of compromise.
Microsoft 365 Phishing: Why This Matters To MSPs
Phishing-as-a-service lowers the barrier for attackers. Kits that automate credential harvesting and session theft can be rented or bought, so even low-skill attackers can run convincing campaigns. For MSPs, that means the volume of attacks will go up, not down.
The use of trusted brand names like OpenAI, SpaceX, and Anthropic makes these lures harder for employees to spot. In general, event invitations and meeting requests are a common social engineering vector, and they often bypass spam filters because they come in as calendar invites or document links.
When a client's account is taken over, the MSP is the one who has to clean it up. Without good backups and a response plan, that can mean days of lost work and a damaged client relationship.
What MSPs Should Do
Take these steps as a standing practice to protect your clients against credential phishing.
- Enable multi-factor authentication (MFA) on all Microsoft 365 and Google accounts. MFA blocks many credential theft attempts even when a password is phished.
- Enforce conditional access policies that require trusted devices and locations.
- Train users to recognize phishing lures, especially event invitations and other social engineering tactics.
- Use email filtering and link protection to block malicious messages before they reach inboxes.
- Monitor for suspicious sign-in anomalies and session activity.
- Have a response plan for a compromised account, including revocation of sessions and password resets.
How EnterProtect Helps
EnterProtect backup keeps clean, restorable copies of your clients' Microsoft 365 and Google data. If an attacker compromises an account and deletes or encrypts data, recovery from a clean backup can get a client running again.
EnterProtect vulnerability scanning is a general tool that identifies exposed software versions in your clients' environments. As a standing practice, patching those versions reduces the risk of common attacks.
Neither EnterProtect product detects, blocks, or prevents phishing campaigns. Their role is to limit the damage once credentials are stolen and to reduce the attack surface through routine patching.
Frequently Asked Questions
How Do Fake Event Invitation Phishing Attacks Work?
Attackers send invitations that look like legitimate events from well-known companies. When an employee clicks a link, they land on a phishing page that mimics a sign-in screen and asks for credentials or a session token. The stolen information lets the attacker access the account.
What Are Phishing-as-a-Service Platforms?
Phishing-as-a-service platforms are toolkits that cybercriminals rent or buy to launch phishing campaigns. They handle hosting, login page templates, and sometimes credential capture, making phishing easier for less technical attackers. BleepingComputer says this campaign used two different such platforms.
How Can I Protect My Organization From Credential Phishing?
Enable multi-factor authentication on all accounts, use conditional access policies, filter email, and train employees to spot phishing. In general, session tokens also need to be protected because they bypass passwords. Regular testing and monitoring help catch problems early.
What Should I Do If a Client Clicked a Phishing Link?
Act fast: revoke the affected session tokens, force a password reset, and check for suspicious activity on the account. Review email rules and forwarding settings, because attackers often create mail rules to hide their activity. If data was stolen, restore from a clean backup and inform anyone affected.
Does This Campaign Affect Only Microsoft Accounts?
No, BleepingComputer reports that the campaign targets both Microsoft and Google accounts. The fake OpenAI, SpaceX, and Anthropic event invitations are the lure for both types of users.
Sources
- Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts (Bleepingcomputer)