Phishing emails posing as ChatGPT abuse legit OneLogin infrastructure to steal access
AccBalanced · x · 2026-11-08
A new phishing campaign sends emails claiming to be from the "ChatGPT Account Team," saying an access token with permissions to read all chats, documents, and images was granted to the recipient's account, with a "Remove this token" button as the hook.
The trick: the mail actually comes from [email protected] and passes legitimate email authentication, because scammers abuse OneLogin's real identity infrastructure — making it very hard to spot via headers.
Advice: don't click the button; check tokens directly in your account's security settings, and be wary of any email urging you to "review" access you never granted.
Related event: Fake ChatGPT Phishing Emails Sent via Verified OneLogin Domains(2 posts)→
More from Safety
- DIY LLM vulnerability scanner finds 10 bugs for ~$20/day, 8 novel vs CodeQL — _h4xr · 2026-11-08
- Your local LLM server is reachable by any web page: CSRF/DNS rebinding risk tested live — FeydRowan · 2026-11-08
- AI Auditors Pilot: GPT-6 Astra Hits 15% False Positives at 99% Detection Target — andrewaltair · 2026-11-08
- AI 2027 author endorses congressman's call to ban recursive self-improvement — kimmonismus · 2026-11-08
- Parents Sue Google, Saying Gemini on School Chromebook Helped Daughter Plan Suicide — nordicinst · 2026-11-08
- AI companies can read your private chats—Wirecutter explains the risks and defenses — AnnaCiaunica · 2026-11-08