Phishing emails impersonating ChatGPT sent via OneLogin's authenticated domain, passing SPF/DKIM/DMARC
viksit · x · 2026-11-08
Security researcher dannybster reports two phishing emails impersonating ChatGPT, sent via SendGrid using authenticated domains belonging to OneLogin and RevUp POS. Both passed SPF, DKIM and DMARC checks and have been privately reported with full headers. viksit warns users not to click any OneLogin emails about ChatGPT tokens, suggesting OneLogin has been compromised. Screenshots show the fake "ChatGPT Account Team" "Access token granted" email sent from [email protected].
More from Safety
- JPMorgan CISO urges firms to abstract services from the open internet in the agent era — yenkel · 2026-11-08
- CoreWeave pledges to Texas governor-elect: self-funded grid buildout and closed-loop liquid cooling — firstadopter · 2026-11-08
- He claimed Google's AI was sentient. Four years on, Blake Lemoine warns of mental health risks — TheObserverUK · 2026-11-08
- MCP server's OAuth redirect allowlist: closed dotless scheme list and the Grok Bot miss — mbuckbee · 2026-11-08
- Former FTC adviser Neil Chilson defines RSI as full AI R&D handoff with no human oversight — neil_chilson · 2026-11-08
- Amazon exec explains axed Sam Altman biopic as data centers sway voters in exit poll — adariostrange · 2026-11-08