Email Phishing Scam "You're Cordially Invited"    

The links to "remove yourself", "if you can't see the invitation click here", "to learn about provacy policy", and "add to your address book" all link to the same tinyurl address.

• Change your Google password from a device you trust. Make it long and new, not a variation. Assume the old one is gone for good.
• At myaccount.google.com, open Security. Confirm your recovery email and phone are still yours. Remove any passkeys or app passwords you didn't create.
• Under Security, open Your Devices and sign out of everything except the device you're on. A password change alone does not end an attacker's session. This does.
• If this was a work Google account, tell your administrator today.
• Check Recent Security Activity for sign-ins you don't recognize. If you see one, they were in. Treat everything after that time as read.
• In Gmail Settings, remove any forwarding address, filter, or account delegation you didn't set up. Check Sent and Trash for mail you didn't send.
• Under Security, open Third-party Apps and remove anything unfamiliar.
• Turn on 2-Step Verification. Use an authenticator app or security key, not text messages.
• Change the password on every other account that used the same or similar password. Bank and other email first. Automated tools try stolen logins across hundreds of sites within hours.
• Search your inbox and trash for "reset your password" or "verification code" emails you didn't request. Each one is another compromised account.
• Report the email in Gmail (three-dot menu, Report Phishing). Then run a malware scan. Infection from just visiting the page is unlikely but not something you can rule out after the fact.
• Warn the other recipients. Do not email him. His account is still compromised until he secures it, and every reply goes to the attacker.
• Get a password manager so step 8 never applies to you again.
• Expect more phishing now that they know you click. Anything urgent with a login link is the next attempt.