"An attacker who just wants to spray scam content through a trusted email channel doesn't name the organization after their target, research individual employees, or attach a credit card," wrote Push Security.
How the "Poisoned Tenant" campaign worked
Push Security uncovered a campaign in which threat actors created attacker-controlled OpenAI tenants that impersonated legitimate companies and sent official-looking invitations to employees. The invitation emails were sent from OpenAI's legitimate notification address, noreply@tm.openai.com, passed email authentication checks, and were identical to normal invitations to join an organization's ChatGPT workspace.
According to Push Security and reporting by BleepingComputer, the fake tenants used Gmail addresses to register, yet deliberately named the organization after real companies — in one discovered instance, "Push Security Inc." — and targeted employees using their work email addresses. That targeting, Push Security said, suggests attackers researched individual employees before launching the campaign.
Inside the fraudulent tenant: what Push Security found
To probe the campaign's intent, Luke Jennings, vice president of Research & Development at Push Security, accepted one of the invitations. After accepting, Jennings was immediately added to the impersonating organization and observed a single attacker-controlled account with a Gmail address posting as Push Security's CEO, Adam Bateman. Invited employees had been assigned Owner privileges, granting administrative permissions over the tenant.
Jennings and the invited employees could view pending invitations and confirmed that none of the targeted employees had yet joined the fake ChatGPT organization. The tenant contained no existing chats or projects; it was, in Push Security's words, empty. A Visa credit card had already been attached to the organization's billing account, furthering the appearance of legitimacy.
Why Push Security believes attackers made this investment
Push Security argued the attackers' behavior — naming the tenant after the target, researching employees, assigning Owner privileges, and attaching a payment card — indicates an objective beyond simple spam. The firm wrote that this setup "only pays off if employees actually join the organization and start using it."
Push Security warned of the specific risk on an AI platform: "the data people put into prompts can be extraordinarily sensitive — source code, internal documents, customer data, security research, strategic plans." By convincing victims to treat the attacker-run tenant as a legitimate corporate workspace, attackers could harvest sensitive inputs submitted in chats or projects.
The company also noted that an attached payment method could be used to enable premium features for invited users, removing another potential warning sign and encouraging normal use of the workspace.
How the invitations bypass typical defenses
Unlike conventional phishing that originates from attacker-controlled email infrastructure, these invitations came from OpenAI's notification system and therefore were more likely to bypass email security controls. OpenAI includes a warning when the inviter's email domain does not match the recipient's company domain, but Push Security emphasized that the notice appears as a single line within the otherwise legitimate invitation email — a detail that could be easily missed by busy recipients.
What this means for security teams, affected enterprises, and platform operators
- Security teams: Push Security recommended training employees to verify unexpected organization invitations and monitoring SaaS organization memberships. The campaign shows that platform-originated notifications can be weaponized, so teams will need to add SaaS-invite awareness to phishing and insider-risk training.
- Affected enterprises and procurement leaders: Organizations in the cybersecurity and technology space were among those targeted, Push Security told BleepingComputer. Procurement and IT leaders should pay attention to how third-party collaboration platforms represent organizational identity and billing, and consider processes for verifying external invite legitimacy before assigning high privileges.
- Platform operators (OpenAI and similar services): The campaign highlights an avenue for abuse of legitimate invitation features. BleepingComputer contacted OpenAI to ask whether it has received additional reports of similar campaigns, what protections organizations can use against these attacks, and whether it plans to introduce additional safeguards to prevent attackers from creating organizations that impersonate legitimate companies; the outlet said it will update the article if OpenAI responds.
Push Security labeled the activity the "Poisoned Tenant" campaign. The core fact is straightforward: an attacker used a legitimate platform feature to create a convincing facsimile of a company's workspace, populated it with a sole attacker account that impersonated leadership, and invited employees with administrative privileges — all while attaching a real payment card and leaving the workspace empty of benign content. Whether targeted employees would have used the tenant in ways that exposed sensitive prompts remains unproven in the record, but Push Security warned that the campaign's design appears intended to elicit exactly that behavior.
Source: BleepingComputer — Cybersecurity firms targeted by fraudulent OpenAI organization invites
