Overview
A novel social engineering campaign dubbed ‘Poisoned Tenant’ is targeting cybersecurity and technology firms by exploiting OpenAI’s legitimate workspace invitation system. Threat actors register fraudulent ChatGPT organisations that impersonate real companies, then invite specific employees — identified through prior reconnaissance — to join them. Because invitations originate from OpenAI’s own notification infrastructure ([email protected]) and pass standard email authentication (SPF/DKIM/DMARC), they are virtually indistinguishable from genuine workspace onboarding emails.
The campaign was discovered by Push Security after several of their own employees received invitations to join a ChatGPT organisation named “Push Security Inc.” — one they had not created.
Technical Analysis
The attack chain is straightforward but effective:
- Tenant Registration: Attackers create an OpenAI organisation using personal Gmail accounts, naming it to match the target company.
- Targeted Invitations: Work email addresses of specific employees are used, suggesting prior OSINT or data-broker sourcing.
- Legitimate Delivery Vector: OpenAI sends the invitation on the attacker’s behalf from its own mail infrastructure, bypassing email security controls.
- Impersonation Inside the Workspace: Upon joining, victims encounter an attacker-controlled account posing as the company’s CEO, with pre-staged content designed to elicit sensitive information.
- Privilege Escalation by Design: Invited employees are granted Owner-level privileges, potentially allowing further manipulation of the tenant or invitation of additional targets.
OpenAI does include a domain-mismatch warning in the invitation email, but it appears as a low-prominence single line, easily overlooked.
Framework Mapping
- AML.T0012 (Valid Accounts): Attackers abuse legitimate OpenAI account creation to establish a trusted operational base.
- AML.T0047 (ML-Enabled Product or Service): The attack weaponises OpenAI’s ChatGPT platform infrastructure as the delivery mechanism.
- AML.T0057 (LLM Data Leakage): The ultimate objective is inducing victims to submit sensitive corporate data into an attacker-monitored LLM workspace.
- LLM06 (Sensitive Information Disclosure): Employees interacting with the fake workspace may inadvertently expose proprietary information.
- LLM09 (Overreliance): The attack exploits implicit trust users place in familiar SaaS platforms, particularly enterprise AI tools.
Impact Assessment
The campaign specifically targets cybersecurity and technology companies — sectors whose employees routinely handle sensitive vulnerability data, client intelligence, and internal security tooling. An employee who submits details of an ongoing incident, a security assessment, or internal architecture into the fraudulent workspace would be providing high-value intelligence directly to attackers. The use of Owner-level privileges also means a compromised employee could inadvertently invite colleagues, amplifying the attack’s reach within an organisation.
Mitigation & Recommendations
- Verify inviter identity out-of-band: Never accept OpenAI workspace invitations without confirming directly with the sender via a separate channel.
- Check the inviter’s email domain: OpenAI’s warning about domain mismatches should be treated as an immediate red flag requiring investigation.
- Establish an approved-workspace registry: Organisations should document and communicate which AI platform tenants employees are authorised to join.
- Security awareness training: Include AI platform social engineering scenarios in phishing simulation programmes.
- Monitor OpenAI organisation memberships: Periodically audit which ChatGPT workspaces employees are members of.
- Request OpenAI platform controls: Advocate for stronger tenant verification and domain-matching enforcement at the platform level.
References
- BleepingComputer — Cybersecurity firms targeted by fraudulent OpenAI organization invites
- Push Security — Poisoned Tenant Campaign Report (referenced in article)