Cybersecurity firms targeted by fraudulent OpenAI organization invites

Threat actors are sending legitimate OpenAI organization invitations that impersonate companies to trick employees into submitting sensitive data. Push Security discovered the "Poisoned Tenant" campaign after employees received invites to a fake "Push Security Inc." tenant created by attackers using Gmail addresses. The invitations came from OpenAI's official notification address and passed email authentication checks.