The article describes real phishing activity seen across multiple enterprise customers, where attackers used well-known AI brands as lures because employees now expect routine AI-related emails. It includes concrete subject lines, a suspicious impersonation domain, and an example of abusing legitimate Zoom infrastructure to make a fraudulent event invite look credible.
This was a live phishing campaign observed across multiple enterprise customers that used well-known AI brand names as lures rather than attacking AI systems directly. Three distinct pretexts stood out:
noreply-zoomevents[@]zoom.us.The common thread across all three lures is that employees now expect routine email traffic from AI products, and attackers are counting on that familiarity to lower suspicion. Each pretext borrowed the reputation of a trusted brand (Anthropic, Google/Gemini, OpenAI) while relying on the recipient not checking the actual sending infrastructure closely. In the Zoom case, the use of genuine zoom.us URLs made the registration flow look technically legitimate even though the underlying invitation was fraudulent.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They used well-known AI brand names like Anthropic, Google/Gemini, and OpenAI as lures, since employees now expect routine AI-related emails and are less suspicious of them.
One lure impersonated OpenAI in an invite for a 'Partner Summit 2026' but the message originated from Zoom's event notification address, and the registration flow used legitimate zoom.us URLs to lend the fraudulent invite credibility.
Finance and accounts payable staff were targeted with a fake Anthropic contract/invoice payment request, marketing and advertising staff with a fake Gemini Ads invitation, and executives or business development staff with the fake OpenAI partner summit invite.
The source notes that AI-related SOC alerts grew rapidly but only a small fraction were confirmed real attacks, and this phishing campaign was identified as one of the real ones.
You’re getting way more AI emails now, right? Attackers know that, and they’re riding those brands to phish you. One real case: subject line says, 'RE: Anthropic Engagement approval & payment.' Inside, it cites a supposed Anthropic contract to rush a large payment. Anthropic isn’t the sender, it’s just the bait. Another: a 'Google/Gemini Ads' invite pushing you to join a workspace at gemini-advertisers.com, or an OpenAI Zoom event that really just abuses zoom.us to look legit. Familiar brand, unfamiliar domain, that’s your aha moment. So when any AI-brand email asks for money or to join something, pause. One action: close the email and verify the request through a trusted channel you open yourself.
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…