We need answer only headline <=90 chars factual, no five-word sequence with external source. Need craft new headline. Facts: phishing attack

En bref

• Phishing crews are luring employees with bogus event invitations.
• Two phishing-as-a-service offerings are involved, lowering the barrier to entry.
• The objective is account credentials and active authentication sessions tied to Microsoft and Google.
• Brand names referenced include OpenAI, SpaceX, Anthropic, Microsoft and Google.

A credential-harvesting operation is targeting workers through counterfeit calendar and event invitations, according to the available facts. The lures are designed to push recipients toward pages that collect usernames, passwords and active sign-in tokens for Microsoft and Google accounts. The campaign is tied to two rented phishing services, a model that lets less-skilled actors launch convincing attacks quickly.

Employees are the primary targets. The brand references in the lure set include OpenAI, SpaceX, Anthropic, Microsoft and Google, which suggests attackers are borrowing trusted technology names to increase click-through. For a school district or government agency, a single compromised mailbox can expose student records, vendor conversations, payroll threads and internal planning documents.

The most important risk is not only password loss. Session-token theft can let an attacker bypass MFA by replaying a stolen cookie or token, so a user may never see a new prompt. That makes post-compromise detection harder and raises the chance of mailbox rules, forwarding and lateral phishing.

Phishing kits sold as a service are a force multiplier. They provide hosted pages, evasion features and campaign templates, so two platforms can support many operators. Fake invitations are effective because they look routine and often arrive from compromised or lookalike domains.

Watch for unexpected event invites, especially from external senders; sign-in anomalies; new MFA methods; mailbox forwarding; and token replay from unusual locations. Treat reports of suspicious invitations as high-value signals and preserve URLs for blocking.

À faire maintenant

1. Enforce phishing-resistant MFA such as FIDO2 or passkeys for privileged and high-risk users, then expand to all staff.
2. Enable token protection and conditional access policies that bind sessions to compliant devices; block legacy authentication.
3. Revoke sessions and reset credentials for any confirmed credential or token theft; review mailbox rules and forwarding.
4. Block known phishing-as-a-service domains and fake-event lure URLs at email and web gateways; add detections for lookalike domains.
5. Configure external calendar invite warnings and restrict automatic forwarding to external addresses.
6. Run a short awareness push focused on unsolicited event invitations and require out-of-band verification.
7. Monitor sign-in logs for impossible travel, new MFA enrollment and anomalous OAuth consent; alert on token replay patterns.

Source originale

BleepingComputer